TI-2023-01880 Aliases CVE-2023-1998

Spectre v2 SMT mitigations problem in Linux kernel

MEDIUM 58CWE-1303Published 2023-04-21 · Updated 2025-02-13

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 19 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-203.

Summary

The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01377 72nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Linux Kernel (Linux): 6.3Red Hat: 8 advisoriesRed Hat: 19 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Linux	Linux Kernel	before 6.3	6.3	Patch available	CNA

Linux Kernel VendorLinux Affected before 6.3 Fixed in 6.3 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:linux:linux_kernel::::::::	before 6.3	Vulnerable	Linux
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 6.3 Vulnerable ·Linux
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Fix · CNA Linux Kernel (Linux) Fixed in 6.3

Red Hat 8 advisories

RHSA-2024:3810 Released 2024-06-11 · Red Hat rating Moderate
kernel security and bug fix update
- Red Hat CodeReady Linux Builder EUS (v.8.8) kernel-tools-libs-devel-4.18.0-477.58.1.el8_8
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) bpftool-4.18.0-477.58.1.el8_8, kernel-4.18.0-477.58.1.el8_8, kernel-abi-stablelists-4.18.0-477.58.1.el8_8 +19
RHSA-2024:0412 Released 2024-01-25 · Red Hat rating Important
kernel security and bug fix update
- Red Hat CodeReady Linux Builder EUS (v.8.6) kernel-tools-libs-devel-4.18.0-372.87.1.el8_6
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) bpftool-4.18.0-372.87.1.el8_6, kernel-4.18.0-372.87.1.el8_6, kernel-abi-stablelists-4.18.0-372.87.1.el8_6 +19
- Red Hat Virtualization 4 Hypervisor for RHEL 8 kernel-devel-4.18.0-372.87.1.el8_6, perf-4.18.0-372.87.1.el8_6
RHSA-2023:7077 Released 2023-11-14 · Red Hat rating Important
kernel security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder (v. 8) kernel-tools-libs-devel-4.18.0-513.5.1.el8_9
- Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-513.5.1.el8_9, kernel-4.18.0-513.5.1.el8_9, kernel-abi-stablelists-4.18.0-513.5.1.el8_9 +19

Show 5 more Red Hat advisories

RHSA-2023:6901 Released 2023-11-14 · Red Hat rating Important
kernel-rt security, bug fix, and enhancement update
- Red Hat Enterprise Linux Real Time (v. 8) kernel-rt-4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-core-4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-debug-4.18.0-513.5.1.rt7.307.el8_9 +7
- Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt-4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-core-4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-debug-4.18.0-513.5.1.rt7.307.el8_9 +9
RHSA-2023:5604 Released 2023-10-10 · Red Hat rating Important
kernel security and bug fix update
- Red Hat CodeReady Linux Builder EUS (v.9.0) kernel-tools-libs-devel-5.14.0-70.75.1.el9_0
- Red Hat Enterprise Linux AppStream EUS (v.9.0) kernel-debug-devel-5.14.0-70.75.1.el9_0, kernel-debug-devel-matched-5.14.0-70.75.1.el9_0, kernel-devel-5.14.0-70.75.1.el9_0 +5
- Red Hat Enterprise Linux BaseOS EUS (v.9.0) bpftool-5.14.0-70.75.1.el9_0, kernel-5.14.0-70.75.1.el9_0, kernel-abi-stablelists-5.14.0-70.75.1.el9_0 +14
RHSA-2023:5603 Released 2023-10-10 · Red Hat rating Important
kernel-rt security and bug fix update
- Red Hat Enterprise Linux Real Time EUS (v.9.0) kernel-rt-5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-core-5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-debug-5.14.0-70.75.1.rt21.146.el9_0 +7
- Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0) kernel-rt-5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-core-5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-debug-5.14.0-70.75.1.rt21.146.el9_0 +9
RHSA-2023:4377 Released 2023-08-01 · Red Hat rating Important
kernel security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-284.25.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.25.1.el9_2, kernel-64k-devel-5.14.0-284.25.1.el9_2 +10
- Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.0.0-284.25.1.el9_2, kernel-5.14.0-284.25.1.el9_2, kernel-64k-5.14.0-284.25.1.el9_2 +29
- Red Hat Enterprise Linux CRB (v. 9) kernel-tools-libs-devel-5.14.0-284.25.1.el9_2
RHSA-2023:4378 Released 2023-08-01 · Red Hat rating Important
kernel-rt security and bug fix update
- Red Hat Enterprise Linux NFV (v. 9) kernel-rt-5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-core-5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-debug-5.14.0-284.25.1.rt14.310.el9_2 +11
- Red Hat Enterprise Linux RT (v. 9) kernel-rt-5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-core-5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-debug-5.14.0-284.25.1.rt14.310.el9_2 +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat CodeReady Linux Builder (v. 8)	Fixed	RHSA-2023:7077
Red Hat CodeReady Linux Builder EUS (v.8.6)	Fixed	RHSA-2024:0412
Red Hat CodeReady Linux Builder EUS (v.8.8)	Fixed	RHSA-2024:3810
Red Hat CodeReady Linux Builder EUS (v.9.0)	Fixed	RHSA-2023:5604
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2023:4377
Red Hat Enterprise Linux AppStream EUS (v.9.0)	Fixed	RHSA-2023:5604
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2023:7077
Red Hat Enterprise Linux BaseOS (v. 9)	Fixed	RHSA-2023:4377
Red Hat Enterprise Linux BaseOS EUS (v.8.6)	Fixed	RHSA-2024:0412
Red Hat Enterprise Linux BaseOS EUS (v.8.8)	Fixed	RHSA-2024:3810
Red Hat Enterprise Linux BaseOS EUS (v.9.0)	Fixed	RHSA-2023:5604
Red Hat Enterprise Linux CRB (v. 9)	Fixed	RHSA-2023:4377
Red Hat Enterprise Linux NFV (v. 9)	Fixed	RHSA-2023:4378
Red Hat Enterprise Linux RT (v. 9)	Fixed	RHSA-2023:4378
Red Hat Enterprise Linux Real Time (v. 8)	Fixed	RHSA-2023:6901
Red Hat Enterprise Linux Real Time EUS (v.9.0)	Fixed	RHSA-2023:5603
Red Hat Enterprise Linux Real Time for NFV (v. 8)	Fixed	RHSA-2023:6901
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0)	Fixed	RHSA-2023:5603
Red Hat Virtualization 4 Hypervisor for RHEL 8	Fixed	RHSA-2024:0412

Timeline

2026-10-02 Threatist record created from CVE-2023-1998

References

Exploit 1

https://github.com/google/security-research/security/advisories/GHSA-mj4w-6495-6crx

Patch 1

https://github.com/torvalds/linux/commit/6921ed9049bc7457f66c1596c5b78aec0dae4a9d

Advisory 2

Other 1

https://kernel.dance/#6921ed9049bc7457f66c1596c5b78aec0dae4a9d

TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3

See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences