NetSight
IP …
medium5.5

CVE-2023-52997

In the Linux kernel, the following vulnerability has been resolved: ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() if (!type) continue; if (…

Impact

In the Linux kernel, the following vulnerability has been resolved: ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() if (!type) continue; if (type > RTAX_MAX) return -EINVAL; ... metrics[type - 1] = val; @type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.3 before 4.19.272
from 4.20 before 5.4.231
from 5.5 before 5.10.166
from 5.11 before 5.15.91
from 5.16 before 6.1.9
Version 6.2

References