Read the docs
TI-2023-13258 Aliases CVE-2023-28746GHSA-36c8-x5g7-w9x4

Information exposure through microarchitectural state after transient execution from some…

Priority LOW 30CWE-1342Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 12 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00546 45th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 12 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Intel(R) Atom(R) ProcessorsSee references—No fix listedCNA
  • Intel(R) Atom(R) Processors Vendor— Affected See references Fixed in — No fix listed CNA

Remediation

Red Hat 5 advisories

  • RHSA-2024:9401 Released 2024-11-12 · Red Hat rating Moderate
    microcode_ctl security update
    • Red Hat Enterprise Linux BaseOS (v. 9) microcode_ctl-4:20240910-1.el9_5
  • RHSA-2024:8162 Released 2024-10-16 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-427.40.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.40.1.el9_4, kernel-64k-devel-5.14.0-427.40.1.el9_4 +11
    • Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.3.0-427.40.1.el9_4, kernel-5.14.0-427.40.1.el9_4, kernel-64k-5.14.0-427.40.1.el9_4 +29
    • Red Hat Enterprise Linux CRB (v. 9) kernel-tools-libs-devel-5.14.0-427.40.1.el9_4, libperf-5.14.0-427.40.1.el9_4
    • Red Hat Enterprise Linux NFV (v. 9) kernel-rt-5.14.0-427.40.1.el9_4, kernel-rt-core-5.14.0-427.40.1.el9_4, kernel-rt-debug-5.14.0-427.40.1.el9_4 +11
    • Red Hat Enterprise Linux RT (v. 9) kernel-rt-5.14.0-427.40.1.el9_4, kernel-rt-core-5.14.0-427.40.1.el9_4, kernel-rt-debug-5.14.0-427.40.1.el9_4 +9
  • RHSA-2024:8157 Released 2024-10-16 · Red Hat rating Moderate
    kernel security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) kernel-tools-libs-devel-5.14.0-284.88.1.el9_2
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) kernel-64k-debug-devel-5.14.0-284.88.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.88.1.el9_2, kernel-64k-devel-5.14.0-284.88.1.el9_2 +10
    • Red Hat Enterprise Linux BaseOS EUS (v.9.2) bpftool-7.0.0-284.88.1.el9_2, kernel-5.14.0-284.88.1.el9_2, kernel-64k-5.14.0-284.88.1.el9_2 +29
Show 2 more Red Hat advisories
  • RHSA-2024:8158 Released 2024-10-16 · Red Hat rating Moderate
    kernel-rt security update
    • Red Hat Enterprise Linux Real Time EUS (v.9.2) kernel-rt-5.14.0-284.88.1.rt14.373.el9_2, kernel-rt-core-5.14.0-284.88.1.rt14.373.el9_2, kernel-rt-debug-5.14.0-284.88.1.rt14.373.el9_2 +9
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2) kernel-rt-5.14.0-284.88.1.rt14.373.el9_2, kernel-rt-core-5.14.0-284.88.1.rt14.373.el9_2, kernel-rt-debug-5.14.0-284.88.1.rt14.373.el9_2 +11
  • RHSA-2024:5101 Released 2024-08-08 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.16.1.el8_10, kernel-4.18.0-553.16.1.el8_10, kernel-abi-stablelists-4.18.0-553.16.1.el8_10 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.16.1.el8_10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:8157
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:8162
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:8157
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:5101
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:8162, RHSA-2024:9401
Red Hat Enterprise Linux BaseOS EUS (v.9.2)Fixed RHSA-2024:8157
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2024:5101
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:8162
Red Hat Enterprise Linux NFV (v. 9)Fixed RHSA-2024:8162
Red Hat Enterprise Linux RT (v. 9)Fixed RHSA-2024:8162
Red Hat Enterprise Linux Real Time EUS (v.9.2)Fixed RHSA-2024:8158
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.2)Fixed RHSA-2024:8158
Not affected: 2 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux AppStream EUS (v.9.2)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28746
  2. 2026-10-03 Alias added: GHSA-36c8-x5g7-w9x4
  3. 2026-10-29 Affected versions changed · Red Hat

References

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences