CVE-2023-0045: Incorrect indirect branch prediction barrier in the Linux Kernel
Last updated 25 April 2025
Other sources
The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ibprctlset function updates the Thread Information Flags (TIFs) for the task and updates the SPECCTRL MSR on the function speculationctrlupdate, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. The patch that added the support for the conditional mitigation via prctl (ibprctlset) dates back to the kernel 4.9.176.
We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0045?
CVE-2023-0045 is classified with a high severity level due to its potential to affect system security during syscall execution.
How do I fix CVE-2023-0045?
To remediate CVE-2023-0045, upgrade to the patched versions of the affected Linux Kernel as specified in the advisory.
Which systems are affected by CVE-2023-0045?
CVE-2023-0045 affects multiple versions of the Linux Kernel between 3.16.68 and various versions above 4.5, including certain Debian operating systems.
What is the main impact of CVE-2023-0045?
The main impact of CVE-2023-0045 is that it can lead to potential information leakage during the execution of syscalls.
Is CVE-2023-0045 currently being exploited?
As of now, there is no public evidence that CVE-2023-0045 is actively being exploited, but it is recommended to apply the patches to mitigate any risks.