CVE-2023-52997

A vulnerability was found in the Linux kernel's ip_metrics_convert() function, where improper handling of user input can potentially leak kernel memory via side channels. This issue is caused by the use of @type, a user-controlled input, which is an array within this function. If a CPU speculatively executes instructions past the conditional branch before the branch condition is resolved, the line metrics[type - 1] = val may be evaluated. A situation where type is out-of-bounds could lead to improper kernel memory access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.