Log in Start free

Vulnerability · Published May 31, 2023 · Assigned by redhat

CVE-2023-3006

Medium 5.5

In plain English

A medium-severity security flaw in Kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 81.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.0.7-1DEBIAN-CVE-2023-3006
Debian:13linux6.0.7-1DEBIAN-CVE-2023-3006
Debian:14linux6.0.7-1DEBIAN-CVE-2023-3006
Ubuntu:22.04:LTSlinux5.15.0-60.66UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-aws5.15.0-1030.34UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-azure5.15.0-1033.40UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1033.40.1UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-gcp5.15.0-1029.36UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-gke5.15.0-1027.32UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1015.19UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-hwe-5.195.19.0-32.33~22.04.1UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-ibm5.15.0-1025.28UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1025.30UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-kvm5.15.0-1028.33UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-60.66UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1017.17UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-oem-6.06.0.0-1008.8UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-oracle5.15.0-1029.35UBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-raspi5.15.0-1024.26UBUNTU-CVE-2023-3006
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-3006
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-3006

Affected products (as reported)

VendorProductVersions
n/a Kernel Linux Kernel 6.1-rc1

Weakness: CWE-226 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References