medium 5.3

CVE-2023-0458 json

Spectre V1 Gadget in do_prlimit in the Linux Kernel

published 2023-04-26 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-12512

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits: 0; none known

A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit 739790605705ddcf18f21782b9c99ad7d53a8c11

Patch / fix

fixed in 1 distros 6 links 2

linux linux_kernel 6.1.8

debian ubuntu red hat almalinux rocky linux azure linux

linux Debian 14, Debian 13, Debian 12 6.1.8-1

debian advisories DEBIAN-CVE-2023-0458

linux Ubuntu 18.04 LTS 4.15.0-209.220
linux Ubuntu 20.04 LTS 5.4.0-147.164
linux Ubuntu 22.04 LTS 5.15.0-70.77
linux-aws Ubuntu 18.04 LTS 4.15.0-1154.167
linux-aws Ubuntu 20.04 LTS 5.4.0-1100.108
linux-aws Ubuntu 22.04 LTS 5.15.0-1034.38
linux-gcp Ubuntu 20.04 LTS 5.4.0-1103.112
linux-gcp Ubuntu 22.04 LTS 5.15.0-1032.40

ubuntu advisories UBUNTU-CVE-2023-0458

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

perf rhev hypervisor 4.4, RHEL 8.6 EUS 4.18.0-372.91.1.el8_6
kernel RHEL 8 4.18.0-513.5.1.el8_9
perf RHEL 8 4.18.0-513.5.1.el8_9
bpftool RHEL 8 4.18.0-513.5.1.el8_9
kernel-core RHEL 8 4.18.0-513.5.1.el8_9
kernel-tools RHEL 8 4.18.0-513.5.1.el8_9
python3-perf RHEL 8 4.18.0-513.5.1.el8_9
kernel-modules RHEL 8 4.18.0-513.5.1.el8_9

red hat advisories RHSA-2024:0724 RHSA-2023:4801 RHSA-2023:7077 RHSA-2023:6901 RHSA-2024:0575 RHSA-2023:4814

kernel AlmaLinux 8 4.18.0-513.5.1.el8_9
perf AlmaLinux 8 4.18.0-513.5.1.el8_9
bpftool AlmaLinux 8 4.18.0-513.5.1.el8_9
kernel-core AlmaLinux 8 4.18.0-513.5.1.el8_9
kernel-tools AlmaLinux 8 4.18.0-513.5.1.el8_9
python3-perf AlmaLinux 8 4.18.0-513.5.1.el8_9
kernel-modules AlmaLinux 8 4.18.0-513.5.1.el8_9
kernel-zfcpdump AlmaLinux 8 4.18.0-513.5.1.el8_9

almalinux advisories ALSA-2023:7077 ALSA-2023:4377 ALSA-2023:4378

kernel-rt Rocky Linux 9 5.14.0-284.25.1.rt14.310.el9_2

rocky linux advisories RLSA-2023:4378

kernel CBL-Mariner 2.0 5.15.111.1-1

azure linux advisories AZL-26415

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-0458 updated 2026-11-07 cvss 4.7

kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c

Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: workaround, no fix planned “Out of support scope”
Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-513.5.1.el8_9, kernel-debuginfo-common-aarch64 4.18.0-513.5.1.el8_9, kernel-debuginfo-common-ppc64le 4.18.0-513.5.1.el8_9
fixed: vendor fix RHSA-2023:7077
Red Hat CodeReady Linux Builder EUS (v.8.6) kernel-debuginfo-common-x86_64 4.18.0-372.91.1.el8_6, kernel-debuginfo-common-aarch64 4.18.0-372.91.1.el8_6, kernel-debuginfo-common-ppc64le 4.18.0-372.91.1.el8_6
fixed: vendor fix RHSA-2024:0724
Red Hat CodeReady Linux Builder EUS (v.8.8) kernel-debuginfo-common-x86_64 4.18.0-477.43.1.el8_8, kernel-debuginfo-common-aarch64 4.18.0-477.43.1.el8_8, kernel-debuginfo-common-ppc64le 4.18.0-477.43.1.el8_8
fixed: vendor fix RHSA-2024:0575
Red Hat CodeReady Linux Builder EUS (v.9.0) kernel-debuginfo-common-s390x 5.14.0-70.70.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.70.1.el9_0, kernel-debuginfo-common-aarch64 5.14.0-70.70.1.el9_0, kernel-debuginfo-common-ppc64le 5.14.0-70.70.1.el9_0
fixed: vendor fix RHSA-2023:4801
Red Hat Enterprise Linux AppStream (v. 9) perf 5.14.0-284.25.1.el9_2, rtla 5.14.0-284.25.1.el9_2, kernel-devel-matched 5.14.0-284.25.1.el9_2, kernel-64k-devel-matched 5.14.0-284.25.1.el9_2, kernel-debug-devel-matched 5.14.0-284.25.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.25.1.el9_2, +5 more
fixed: vendor fix RHSA-2023:4377
Red Hat Enterprise Linux AppStream EUS (v.9.0) perf 5.14.0-70.70.1.el9_0, kernel-devel-matched 5.14.0-70.70.1.el9_0, kernel-debug-devel-matched 5.14.0-70.70.1.el9_0, kernel-debuginfo-common-s390x 5.14.0-70.70.1.el9_0, kernel-zfcpdump-devel-matched 5.14.0-70.70.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.70.1.el9_0, +2 more
fixed: vendor fix RHSA-2023:4801
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-513.5.1.el8_9, kernel 4.18.0-513.5.1.el8_9, bpftool 4.18.0-513.5.1.el8_9, kernel-core 4.18.0-513.5.1.el8_9, kernel-tools 4.18.0-513.5.1.el8_9, python3-perf 4.18.0-513.5.1.el8_9, +15 more
fixed: vendor fix RHSA-2023:7077

show 13 more

Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.0.0-284.25.1.el9_2, kernel 5.14.0-284.25.1.el9_2, kernel-64k 5.14.0-284.25.1.el9_2, kernel-core 5.14.0-284.25.1.el9_2, kernel-tools 5.14.0-284.25.1.el9_2, python3-perf 5.14.0-284.25.1.el9_2, +28 more
fixed: vendor fix RHSA-2023:4377
Red Hat Enterprise Linux BaseOS EUS (v.8.6) perf 4.18.0-372.91.1.el8_6, kernel 4.18.0-372.91.1.el8_6, bpftool 4.18.0-372.91.1.el8_6, kernel-core 4.18.0-372.91.1.el8_6, kernel-tools 4.18.0-372.91.1.el8_6, python3-perf 4.18.0-372.91.1.el8_6, +15 more
fixed: vendor fix RHSA-2024:0724
Red Hat Enterprise Linux BaseOS EUS (v.8.8) perf 4.18.0-477.43.1.el8_8, kernel 4.18.0-477.43.1.el8_8, bpftool 4.18.0-477.43.1.el8_8, kernel-core 4.18.0-477.43.1.el8_8, kernel-tools 4.18.0-477.43.1.el8_8, python3-perf 4.18.0-477.43.1.el8_8, +15 more
fixed: vendor fix RHSA-2024:0575
Red Hat Enterprise Linux BaseOS EUS (v.9.0) kernel 5.14.0-70.70.1.el9_0, bpftool 5.14.0-70.70.1.el9_0, kernel-core 5.14.0-70.70.1.el9_0, kernel-tools 5.14.0-70.70.1.el9_0, python3-perf 5.14.0-70.70.1.el9_0, kernel-modules 5.14.0-70.70.1.el9_0, +14 more
fixed: vendor fix RHSA-2023:4801
Red Hat Enterprise Linux CRB (v. 9) kernel-debuginfo-common-s390x 5.14.0-284.25.1.el9_2, kernel-debuginfo-common-x86_64 5.14.0-284.25.1.el9_2, kernel-debuginfo-common-aarch64 5.14.0-284.25.1.el9_2, kernel-debuginfo-common-ppc64le 5.14.0-284.25.1.el9_2
fixed: vendor fix RHSA-2023:4377
Red Hat Enterprise Linux NFV (v. 9) kernel-rt 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-kvm 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-core 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-modules 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-debug-kvm 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-debug-core 5.14.0-284.25.1.rt14.310.el9_2, +6 more
fixed: vendor fix RHSA-2023:4378
Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-core 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-modules 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-debug-core 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-debug-modules 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-modules-extra 4.18.0-513.5.1.rt7.307.el8_9, +2 more
fixed: vendor fix RHSA-2023:6901
Red Hat Enterprise Linux Real Time EUS (v.9.0) kernel-rt 5.14.0-70.70.1.rt21.141.el9_0, kernel-rt-core 5.14.0-70.70.1.rt21.141.el9_0, kernel-rt-modules 5.14.0-70.70.1.rt21.141.el9_0, kernel-rt-debug-core 5.14.0-70.70.1.rt21.141.el9_0, kernel-rt-debug-modules 5.14.0-70.70.1.rt21.141.el9_0, kernel-rt-modules-extra 5.14.0-70.70.1.rt21.141.el9_0, +2 more
fixed: vendor fix RHSA-2023:4814
Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-kvm 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-core 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-modules 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-debug-kvm 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-debug-core 4.18.0-513.5.1.rt7.307.el8_9, +4 more
fixed: vendor fix RHSA-2023:6901
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0) kernel-rt 5.14.0-70.70.1.rt21.141.el9_0, kernel-rt-kvm 5.14.0-70.70.1.rt21.141.el9_0, kernel-rt-core 5.14.0-70.70.1.rt21.141.el9_0, kernel-rt-modules 5.14.0-70.70.1.rt21.141.el9_0, kernel-rt-debug-kvm 5.14.0-70.70.1.rt21.141.el9_0, kernel-rt-debug-core 5.14.0-70.70.1.rt21.141.el9_0, +4 more
fixed: vendor fix RHSA-2023:4814
Red Hat Enterprise Linux RT (v. 9) kernel-rt 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-core 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-modules 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-debug-core 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-modules-core 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-debug-modules 5.14.0-284.25.1.rt14.310.el9_2, +4 more
fixed: vendor fix RHSA-2023:4378
Red Hat Virtualization 4 Hypervisor for RHEL 8 perf 4.18.0-372.91.1.el8_6, kernel-debuginfo-common-x86_64 4.18.0-372.91.1.el8_6
fixed: vendor fix RHSA-2024:0724
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux AppStream (v. 9) kernel-doc 5.14.0-284.25.1.el9_2
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 21 mo ago (2025-01-30)

Exploit prediction

0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	4.7	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Linux Linux Kernel

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

github.com /torvalds/linux/commit/739790605705ddcf18f21782b9c99ad7d53a8c11
patch
git.kernel.org /pub/scm/linux/kernel/git/stable/linux.git/diff/kernel/sys.c?id=v6.1.8&id2=v6.1.7
patch
lists.debian.org /debian-lts-announce/2023/05/msg00005.html
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2023/05/msg00006.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2023-0458
NVD CVE-2023-0458

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary