CVE-2023-0045

kernel: Bypassing Spectre-BTI User Space Mitigations

Loading…

Severity

Low

Red Hat Product Security

4.7

CVSS 3.1

Review impact separately from score.

Published · February 3, 2023

Updated · August 7, 2026

Description

A flaw was found in the Linux kernel. This issue occurs due to a failure mitigating the Spectre-BTI attack (using the kernel API), as IBPB is not issued during the syscall until the next schedule, leaving the system vulnerable.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

For user-mode applications, a usleep after the prctl call will force a reschedule and ensure the correct mitigation.

CVSS / CWE

CVSS 3.1 · 4.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-610 · Externally Controlled Reference to a Resource in Another Sphere