Vulnerability in Linux Kernel

CVE-2023-3006

A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.003 (17.1th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 17th percentile — 17.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2023-3006: held from 0.003 to 0.003.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

  • Linux Kernel — versions 6.1
  • Kernel — versions Linux Kernel 6.1-rc1

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2023-3006?
CVE-2023-3006 is a medium-severity vulnerability in Linux Kernel, classified under Sensitive Information in Resource Not Removed Before Reuse. CVSS score: 5.5/10. Published 2023-05-31.
How severe is CVE-2023-3006?
Medium severity. CVSS v3 base score is 5.5 out of 10.