CVE-2023-0045
Description
The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96
How to fix
- linux linux_kernel3.17, 4.5, 4.10, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.19, 6.1.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.16.68 ≤ v < 3.17, 4.4.180 ≤ v < 4.5, 4.9.176 ≤ v < 4.10, 4.14.86 ≤ v < 4.14.303, 4.19.7 ≤ v < 4.19.270, 4.20 ≤ v < 5.4.229, 5.5.0 ≤ v < 5.10.163, 5.11 ≤ v < 5.15.87, 5.16 ≤ v < 6.0.19, 6.1 ≤ v < 6.1.5 | 3.17, 4.5, 4.10, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.19, 6.1.5 |
| debian debian_linux | 10.0 | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp h300s_firmware | No range specified | — |
| netapp h500s_firmware | No range specified | — |
| netapp h700s_firmware | No range specified | — |
| netapp h410s_firmware | No range specified | — |
| netapp h410c_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.