Linux kernel (net/xfrm): The 32-bit compat translation of xfrm netlink attributes uses the attacker-supplied attribute

CVSS 4.7CVE-2023-52746Kernel, userspace & hypervisorcurated

Impact

The 32-bit compat translation of xfrm netlink attributes uses the attacker-supplied attribute type as an array index after a bounds check that the CPU can speculate past. This is a Spectre v1 gadget in the xfrm netlink parser: architecturally safe, but speculatively it reads kernel memory outside the policy table and can leak it through a cache side channel.

Who can reach it

A 32-bit process sending xfrm netlink messages, needing CAP_NET_ADMIN in the network namespace - which a container granted NET_ADMIN with its own netns has, and CONFIG_COMPAT plus a 32-bit or compat-capable tenant binary. Turning the gadget into an actual leak requires a working speculation side channel, so treat this as a hardening gap rather than a directly weaponizable read.

What to do

Boot a kernel carrying the linked stable commits (which add array_index_nospec). Interim: drop CAP_NET_ADMIN from tenant containers, or build/boot without CONFIG_COMPAT on nodes that never run 32-bit workloads.

References

https://git.kernel.org/stable/c/a893cc644812728e86e9aff517fd5698812ecef0 https://git.kernel.org/stable/c/5dc688fae6b7be9dbbf5304a3d2520d038e06db5 https://nvd.nist.gov/vuln/detail/CVE-2023-52746

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.