Skip to content
Fencer Vulns
medium 5.6

CVE-2023-1998 json

Spectre v2 SMT mitigations problem in Linux kernel

published 2023-04-21 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-24178

cvss
5.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
1
Exploit-DB

Summary

The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line.

This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects.

Patch / fix

  • Linux Linux Kernel 6.3
  • linux Debian 14, Debian 13, Debian 12 6.1.20-1

debian advisories DEBIAN-CVE-2023-1998

  • linux Ubuntu 20.04 LTS 5.4.0-152.169
  • linux Ubuntu 22.04 LTS 5.15.0-75.82
  • linux-aws Ubuntu 20.04 LTS 5.4.0-1104.112
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1038.43
  • linux-gcp Ubuntu 20.04 LTS 5.4.0-1107.116
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1036.44
  • linux-gke Ubuntu 20.04 LTS 5.4.0-1102.109
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1036.41

ubuntu advisories UBUNTU-CVE-2023-1998

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perf rhev hypervisor 4.4, RHEL 8.6 EUS 4.18.0-372.87.1.el8_6
  • kernel RHEL 8 4.18.0-513.5.1.el8_9
  • perf RHEL 8 4.18.0-513.5.1.el8_9
  • bpftool RHEL 8 4.18.0-513.5.1.el8_9
  • kernel-core RHEL 8 4.18.0-513.5.1.el8_9
  • kernel-tools RHEL 8 4.18.0-513.5.1.el8_9
  • python3-perf RHEL 8 4.18.0-513.5.1.el8_9
  • kernel-modules RHEL 8 4.18.0-513.5.1.el8_9

red hat advisories RHSA-2024:0412RHSA-2023:5604RHSA-2023:5603RHSA-2023:7077RHSA-2023:6901RHSA-2024:3810

  • dtb-aarch64 openSUSE Leap 15.5 5.14.21-150500.55.7.1
  • kernel-64kb SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.7.1
  • kernel-syms SLE Module for Development Tools 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.7.1
  • kernel-obs-qa openSUSE Leap 15.5 5.14.21-150500.55.7.1
  • kernel-source SLE Module for Development Tools 15 SP5, SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.7.1
  • kernel-default SLE Workstation Extension 15 SP5, SLE Module for Legacy 15 SP5, SLE Module for Basesystem 15 SP5 +3 more 5.14.21-150500.55.7.1
  • kernel-kvmsmall openSUSE Leap 15.5 5.14.21-150500.55.7.1
  • kernel-zfcpdump SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.7.1

suse advisories SUSE-SU-2023:2871-1SUSE-SU-2023:2809-1SUSE-SU-2023:2805-1SUSE-SU-2023:2232-1SUSE-SU-2023:2646-1SUSE-SU-2023:2231-1

  • kernel AlmaLinux 8 4.18.0-513.5.1.el8_9
  • perf AlmaLinux 8 4.18.0-513.5.1.el8_9
  • bpftool AlmaLinux 8 4.18.0-513.5.1.el8_9
  • kernel-core AlmaLinux 8 4.18.0-513.5.1.el8_9
  • kernel-tools AlmaLinux 8 4.18.0-513.5.1.el8_9
  • python3-perf AlmaLinux 8 4.18.0-513.5.1.el8_9
  • kernel-modules AlmaLinux 8 4.18.0-513.5.1.el8_9
  • kernel-zfcpdump AlmaLinux 8 4.18.0-513.5.1.el8_9

almalinux advisories ALSA-2023:7077ALSA-2023:4377ALSA-2023:4378

  • kernel-rt Rocky Linux 9 5.14.0-284.25.1.rt14.310.el9_2

rocky linux advisories RLSA-2023:4378

  • hyperv-daemons CBL-Mariner 2.0 5.15.118.1-1
  • kernel CBL-Mariner 2.0 5.15.111.1-1

azure linux advisories AZL-26234AZL-26368

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-1998 updated cvss 5.6

kernel: Spectre v2 SMT mitigations problem

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: workaround, no fix planned “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.”
  • Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-513.5.1.el8_9, kernel-debuginfo-common-aarch64 4.18.0-513.5.1.el8_9, kernel-debuginfo-common-ppc64le 4.18.0-513.5.1.el8_9
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:7077
  • Red Hat CodeReady Linux Builder EUS (v.8.6) kernel-debuginfo-common-x86_64 4.18.0-372.87.1.el8_6, kernel-debuginfo-common-aarch64 4.18.0-372.87.1.el8_6, kernel-debuginfo-common-ppc64le 4.18.0-372.87.1.el8_6
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2024:0412
  • Red Hat CodeReady Linux Builder EUS (v.8.8) kernel-debuginfo-common-x86_64 4.18.0-477.58.1.el8_8, kernel-debuginfo-common-aarch64 4.18.0-477.58.1.el8_8, kernel-debuginfo-common-ppc64le 4.18.0-477.58.1.el8_8
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2024:3810
  • Red Hat CodeReady Linux Builder EUS (v.9.0) kernel-debuginfo-common-s390x 5.14.0-70.75.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.75.1.el9_0, kernel-debuginfo-common-aarch64 5.14.0-70.75.1.el9_0, kernel-debuginfo-common-ppc64le 5.14.0-70.75.1.el9_0
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:5604
  • Red Hat Enterprise Linux AppStream (v. 9) perf 5.14.0-284.25.1.el9_2, rtla 5.14.0-284.25.1.el9_2, kernel-devel-matched 5.14.0-284.25.1.el9_2, kernel-64k-devel-matched 5.14.0-284.25.1.el9_2, kernel-debug-devel-matched 5.14.0-284.25.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.25.1.el9_2, +5 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:4377
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) perf 5.14.0-70.75.1.el9_0, kernel-devel-matched 5.14.0-70.75.1.el9_0, kernel-debug-devel-matched 5.14.0-70.75.1.el9_0, kernel-debuginfo-common-s390x 5.14.0-70.75.1.el9_0, kernel-zfcpdump-devel-matched 5.14.0-70.75.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.75.1.el9_0, +2 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:5604
  • Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-513.5.1.el8_9, kernel 4.18.0-513.5.1.el8_9, bpftool 4.18.0-513.5.1.el8_9, kernel-core 4.18.0-513.5.1.el8_9, kernel-tools 4.18.0-513.5.1.el8_9, python3-perf 4.18.0-513.5.1.el8_9, +15 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:7077
show 12 more
  • Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.0.0-284.25.1.el9_2, kernel 5.14.0-284.25.1.el9_2, kernel-64k 5.14.0-284.25.1.el9_2, kernel-core 5.14.0-284.25.1.el9_2, kernel-tools 5.14.0-284.25.1.el9_2, python3-perf 5.14.0-284.25.1.el9_2, +28 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:4377
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) perf 4.18.0-372.87.1.el8_6, kernel 4.18.0-372.87.1.el8_6, bpftool 4.18.0-372.87.1.el8_6, kernel-core 4.18.0-372.87.1.el8_6, kernel-tools 4.18.0-372.87.1.el8_6, python3-perf 4.18.0-372.87.1.el8_6, +15 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2024:0412
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) perf 4.18.0-477.58.1.el8_8, kernel 4.18.0-477.58.1.el8_8, bpftool 4.18.0-477.58.1.el8_8, kernel-core 4.18.0-477.58.1.el8_8, kernel-tools 4.18.0-477.58.1.el8_8, python3-perf 4.18.0-477.58.1.el8_8, +15 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2024:3810
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) kernel 5.14.0-70.75.1.el9_0, bpftool 5.14.0-70.75.1.el9_0, kernel-core 5.14.0-70.75.1.el9_0, kernel-tools 5.14.0-70.75.1.el9_0, python3-perf 5.14.0-70.75.1.el9_0, kernel-modules 5.14.0-70.75.1.el9_0, +14 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:5604
  • Red Hat Enterprise Linux CRB (v. 9) kernel-debuginfo-common-s390x 5.14.0-284.25.1.el9_2, kernel-debuginfo-common-x86_64 5.14.0-284.25.1.el9_2, kernel-debuginfo-common-aarch64 5.14.0-284.25.1.el9_2, kernel-debuginfo-common-ppc64le 5.14.0-284.25.1.el9_2
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:4377
  • Red Hat Enterprise Linux NFV (v. 9) kernel-rt 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-kvm 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-core 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-modules 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-debug-kvm 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-debug-core 5.14.0-284.25.1.rt14.310.el9_2, +6 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:4378
  • Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-core 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-modules 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-debug-core 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-debug-modules 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-modules-extra 4.18.0-513.5.1.rt7.307.el8_9, +2 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:6901
  • Red Hat Enterprise Linux Real Time EUS (v.9.0) kernel-rt 5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-core 5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-modules 5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-debug-core 5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-debug-modules 5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-modules-extra 5.14.0-70.75.1.rt21.146.el9_0, +2 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:5603
  • Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-kvm 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-core 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-modules 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-debug-kvm 4.18.0-513.5.1.rt7.307.el8_9, kernel-rt-debug-core 4.18.0-513.5.1.rt7.307.el8_9, +4 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:6901
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.0) kernel-rt 5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-kvm 5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-core 5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-modules 5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-debug-kvm 5.14.0-70.75.1.rt21.146.el9_0, kernel-rt-debug-core 5.14.0-70.75.1.rt21.146.el9_0, +4 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:5603
  • Red Hat Enterprise Linux RT (v. 9) kernel-rt 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-core 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-modules 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-debug-core 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-modules-core 5.14.0-284.25.1.rt14.310.el9_2, kernel-rt-debug-modules 5.14.0-284.25.1.rt14.310.el9_2, +4 more
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2023:4378
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 perf 4.18.0-372.87.1.el8_6, kernel-debuginfo-common-x86_64 4.18.0-372.87.1.el8_6
    fixed: vendor fix “This flaw can be mitigated by disabling Simultaneous Multithreading (SMT). For instructions on how to disable SMT in RHEL, please see https://access.redhat.com/solutions/rhel-smt.” RHSA-2024:0412

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-51384)
  2. Published

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-51384 Linux Kernel 6.2 - Userspace Processes To Enable Mitigation local, 2023-04-20
  • github.com https://github.com/google/security-research/security/advisories/GHSA-mj4w-6495-6crx referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD 3.1 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

  • Linux Linux Kernel

Classification

Weakness
  • CWE-1303 Non-Transparent Sharing of Microarchitectural Resources
  • CWE-203 Observable Discrepancy
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.