CVE-2023-0458: Spectre V1 Gadget in do_prlimit in the Linux Kernel
A speculative pointer dereference problem exists in the Linux Kernel on the doprlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit 739790605705ddcf18f21782b9c99ad7d53a8c11
Other sources
Linux Kernel could allow a remote authenticated attacker to obtain sensitive information, caused by a speculative pointer dereference in the doprlimit() function. An attacker could exploit this vulnerability to leak the contents and obtain sensitive information.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0458?
CVE-2023-0458 is considered to have a high severity due to the potential for information leakage.
How do I fix CVE-2023-0458?
To fix CVE-2023-0458, upgrade to the Linux kernel version 6.2 or higher.
Which software is affected by CVE-2023-0458?
CVE-2023-0458 affects the Linux Kernel versions prior to 6.1.8 and specific versions of IBM Security Verify Governance and Identity Manager.
What is the nature of the vulnerability in CVE-2023-0458?
CVE-2023-0458 is a speculative pointer dereference issue that can be exploited to leak sensitive data.
Can CVE-2023-0458 be exploited remotely?
CVE-2023-0458 can potentially be exploited locally, making it a concern for systems that allow untrusted user access.