CVE-2023-3006: Medium severity Linux Linux kernel vulnerability
A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.
Other sources
Description of problem: Need Spectre-BHB mitigation added for new HW: Cortex: A57, A72, A76, A77, A78, A78AE, A78C, A710, X1, X2; Neoverse: N1, N2, V1; Ampere1.
https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?id=0e5d5ae837c8
Per AmpereOne erratum AC03CPU12, "Branch history may allow control of speculative execution across software contexts," the AMPERE1 core needs the bhb clearing loop to mitigate Spectre-BHB, with a loop iteration count of 11." And for the other listed hardware the fix is the same like for the AMPERE1 core.
For more information, read previous CVE-2022-23960 that is about Spectre-BHB too.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?id=0e5d5ae837c8
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/Linux Kernelto a version that resolves this vulnerability.Fixed in 6.1 - Compensating control
Add the Spectre-BHB mitigation for the new hardware: Cortex A57, A72, A76, A77, A78, A78AE, A78C, A710; Neoverse N1, N2, V1; and Ampere1. Use a bhb clearing loop mitigation (per the referenced CVE-2022-23960/Spectre-BHB mitigation approach) to prevent cache allocation/information exposure caused by mispredicted branches using shared branch history (BHB).
- Compensating control
For Ampere1 specifically, apply the Spectre-BHB mitigation described in AmpereOne erratum AC03_CPU_12, including the bhb clearing loop with the specified loop iteration count, to mitigate speculative execution across software contexts that could allow information access via mispredicted branches. (AC03_CPU_12 is explicitly referenced in the material.)
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3006?
CVE-2023-3006 is considered a critical vulnerability due to its exploitation potential in cache speculation.
How do I fix CVE-2023-3006?
To mitigate CVE-2023-3006, update the Linux kernel to version 6.1 or apply the patches provided by your distribution.
Which software versions are affected by CVE-2023-3006?
CVE-2023-3006 affects Linux kernel versions prior to 6.1, including earlier releases in the 5.x and 6.x lines.
Who is the vendor for CVE-2023-3006?
CVE-2023-3006 is associated with the Linux Kernel, managed by various Linux distributions such as Red Hat and Debian.
What type of vulnerability is CVE-2023-3006?
CVE-2023-3006 is categorized as a cache speculation vulnerability, specifically related to Branch History Injection techniques.