CVE-2023-3006: Medium severity Linux Linux kernel vulnerability

Published Nov 8, 2022
·
Updated

A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.

Other sources

Description of problem: Need Spectre-BHB mitigation added for new HW: Cortex: A57, A72, A76, A77, A78, A78AE, A78C, A710, X1, X2; Neoverse: N1, N2, V1; Ampere1.

https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?id=0e5d5ae837c8

Per AmpereOne erratum AC03CPU12, "Branch history may allow control of speculative execution across software contexts," the AMPERE1 core needs the bhb clearing loop to mitigate Spectre-BHB, with a loop iteration count of 11." And for the other listed hardware the fix is the same like for the AMPERE1 core.

For more information, read previous CVE-2022-23960 that is about Spectre-BHB too.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?id=0e5d5ae837c8

Red Hat

Affected Software

3 affected componentsFixes available
redhat/Linux Kernel<6.1
6.1
Linux Linux kernel=6.1-rc1
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-16.12.27-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
  2. Upgrade

    Upgrade redhat/Linux Kernel to a version that resolves this vulnerability.

    Fixed in 6.1
  3. Compensating control

    Add the Spectre-BHB mitigation for the new hardware: Cortex A57, A72, A76, A77, A78, A78AE, A78C, A710; Neoverse N1, N2, V1; and Ampere1. Use a bhb clearing loop mitigation (per the referenced CVE-2022-23960/Spectre-BHB mitigation approach) to prevent cache allocation/information exposure caused by mispredicted branches using shared branch history (BHB).

  4. Compensating control

    For Ampere1 specifically, apply the Spectre-BHB mitigation described in AmpereOne erratum AC03_CPU_12, including the bhb clearing loop with the specified loop iteration count, to mitigate speculative execution across software contexts that could allow information access via mispredicted branches. (AC03_CPU_12 is explicitly referenced in the material.)

Event History

Nov 8, 2022
Data Sourced
via Red Hat·02:05 PM
DescriptionSeverityAffected Software
May 31, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
08:15 PM
Description
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 13, 2024
Data Sourced
via Launchpad·12:32 AM
Description
May 4, 2025
Data Sourced
via Ubuntu·11:51 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2023-3006?

CVE-2023-3006 is considered a critical vulnerability due to its exploitation potential in cache speculation.

2

How do I fix CVE-2023-3006?

To mitigate CVE-2023-3006, update the Linux kernel to version 6.1 or apply the patches provided by your distribution.

3

Which software versions are affected by CVE-2023-3006?

CVE-2023-3006 affects Linux kernel versions prior to 6.1, including earlier releases in the 5.x and 6.x lines.

4

Who is the vendor for CVE-2023-3006?

CVE-2023-3006 is associated with the Linux Kernel, managed by various Linux distributions such as Red Hat and Debian.

5

What type of vulnerability is CVE-2023-3006?

CVE-2023-3006 is categorized as a cache speculation vulnerability, specifically related to Branch History Injection techniques.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203