Riskcovery

CVE-2023-52997

ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

State
Published
Severity
Not scored
Published
Mar 27, 2025
Updated
May 11, 2026
Reserved
Mar 27, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

if (!type) continue; if (type > RTAX_MAX) return -EINVAL; ... metrics[type - 1] = val;

@type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to before ef050cf5fb70d995a0d03244e25179b7c66a924aAffected
  • 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to before 746db9ec1e672eee13965625ddac0d97e16fa20cAffected
  • 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to before 34c6142f0df9cd75cba5a7aa9df0960d2854b415Affected
  • 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to before d50e7348b44f1e046121ff5be01b7fb6978a1149Affected
  • 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to before 6850fe301d015a7d2012d1de8caf43dafb7cc2f6Affected
  • 6cf9dfd3bd62edfff69f11c0f111bc261166e4c7 to before 1d1d63b612801b3f0a39b7d4467cad0abd60e5c8Affected
LinuxLinux
  • 4.3Affected
  • before 4.3Not affected
  • 4.19.272 through 4.19.*Not affected
  • 5.4.231 through 5.4.*Not affected
  • 5.10.166 through 5.10.*Not affected
  • 5.15.91 through 5.15.*Not affected
  • 6.1.9 through 6.1.*Not affected
  • 6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.