Vulnerability in Linux Kernel
CVE-2023-3006
A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.
EPSS: 0.003 (18.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Linux Linux_kernel — versions 6.1
- N/a Kernel — versions Linux Kernel 6.1-rc1
Weakness classification (CWE)
References
- secalert@redhat.com (Patch, Mailing List)
Frequently asked questions
- What is CVE-2023-3006?
- CVE-2023-3006 is a medium-severity vulnerability in Linux Kernel, classified under Sensitive Information in Resource Not Removed Before Reuse. CVSS score: 5.5/10. Published 2023-05-31.
- How severe is CVE-2023-3006?
- Medium severity. CVSS v3 base score is 5.5 out of 10.