CVE-2023-53000
netlink: prevent potential spectre v1 gadgets
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
27 Mar 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In the Linux kernel, the following vulnerability has been resolved:
netlink: prevent potential spectre v1 gadgets
Most netlink attributes are parsed and validated from
__nla_validate_parse() or validate_nla()
u16 type = nla_type(nla);
if (type == 0 || type > maxtype) {
/* error or continue */
}
@type is then used as an array index and can be used
as a Spectre v1 gadget.
array_index_nospec() can be used to prevent leaking
content of kernel memory to malicious users.
This should take care of vast majority of netlink uses,
but an audit is needed to take care of others where
validation is not yet centralized in core netlink functions.
Affected products
Linux · LinuxReferences
https://git.kernel.org/stable/c/3e5082b1c66c7783fbcd79b5b178573230e528ffhttps://git.kernel.org/stable/c/41b74e95f297ac360ca7ed6bf200100717cb6c45https://git.kernel.org/stable/c/539ca5dcbc91134bbe2c45677811c31d8b030d2dhttps://git.kernel.org/stable/c/992e4ff7116a77968039277b5d6aaa535c2f2184https://git.kernel.org/stable/c/f0950402e8c76e7dcb08563f1b4e8000fbc62455