CVE-2023-0458 Overview
CVE-2023-0458 is a speculative pointer dereference vulnerability in the Linux Kernel's do_prlimit() function. The resource argument is attacker-controlled and used in pointer arithmetic for the rlim variable. Under speculative execution, this enables out-of-bounds reads that can leak kernel memory contents to a local user. The issue affects Linux Kernel versions prior to 6.1.8 and is tracked under [CWE-476]. Debian also shipped affected kernel packages and published LTS advisories addressing the flaw. The upstream fix is commit 739790605705ddcf18f21782b9c99ad7d53a8c11.
Critical Impact
Local authenticated users can exploit speculative execution in do_prlimit() to read sensitive kernel memory, including data from other processes or the kernel itself.
Affected Products
- Linux Kernel versions prior to 6.1.8 (including 6.2 release candidates rc1 through rc4)
- Debian Linux 10.0
- Distributions shipping the affected upstream kernel kernel/sys.c
Discovery Timeline
- 2023-04-26 - CVE-2023-0458 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-0458
Vulnerability Analysis
The flaw resides in do_prlimit() within kernel/sys.c, which handles the prlimit64 syscall used to query or set process resource limits. The function accepts a resource integer that selects which rlimit entry to operate on. The kernel validates that resource is less than RLIM_NLIMITS before computing rlim = tsk->signal->rlim + resource. While the bounds check prevents architectural out-of-bounds access, modern CPUs can speculatively execute the pointer arithmetic and subsequent load using an attacker-supplied resource value beyond the array. This Spectre v1 style gadget allows transient reads of adjacent kernel memory, with the leaked data observable through microarchitectural side channels such as cache timing.
Root Cause
The root cause is the absence of a speculation barrier between the resource bounds check and the pointer arithmetic that dereferences rlim. The compiler-generated branch can be mispredicted, allowing the speculative load to proceed with an out-of-range index. The fix introduces speculation-safe access patterns to ensure the load is constrained even under misprediction.
Attack Vector
Exploitation requires local access and the ability to invoke the prlimit64 syscall with crafted resource values. The attacker repeatedly trains the branch predictor, then issues calls with out-of-bounds indices while measuring cache state to recover leaked bytes. The attack is non-destructive and leaves no obvious forensic trace in syscall logs. High attack complexity reflects the precision required for reliable side-channel measurement, but no special privileges or user interaction are needed.
No public proof-of-concept exploit is currently available. The upstream patch can be reviewed in the Linux kernel commit 739790605705 and the v6.1.8 stable diff.
Detection Methods for CVE-2023-0458
Indicators of Compromise
- High-frequency prlimit64 syscall invocations from a single non-privileged process targeting varied resource values
- Unprivileged processes exhibiting cache-timing measurement patterns alongside prlimit activity
- Unexpected prlimit64 calls from processes that do not normally manage resource limits
Detection Strategies
- Enable kernel audit rules for the prlimit64 syscall and alert on anomalous call rates per process
- Deploy eBPF probes on do_prlimit to capture the resource argument distribution and flag out-of-range patterns
- Correlate syscall telemetry with performance counter activity to surface side-channel measurement behavior
Monitoring Recommendations
- Track kernel version inventory across Linux hosts and flag systems running versions prior to 6.1.8
- Monitor /proc/*/syscall and audit logs for sustained prlimit64 invocation bursts
- Baseline normal prlimit usage per workload class to identify outliers consistent with side-channel probing
How to Mitigate CVE-2023-0458
Immediate Actions Required
- Upgrade the Linux Kernel to version 6.1.8 or later, or apply the upstream patch at commit 739790605705ddcf18f21782b9c99ad7d53a8c11
- Apply distribution updates for Debian as described in the Debian LTS announcement msg00005 and msg00006
- Restrict local access on multi-tenant systems and remove unnecessary local user accounts
- Verify that existing Spectre v1 mitigations are enabled in the kernel build configuration
Patch Information
The vulnerability is fixed upstream in Linux Kernel 6.1.8 via commit 739790605705ddcf18f21782b9c99ad7d53a8c11, which modifies kernel/sys.c to prevent speculative out-of-bounds access in do_prlimit(). Debian published patched packages through the LTS security stream in May 2023. Distribution maintainers backported the fix into supported stable kernel branches.
Workarounds
- Where patching is not immediately feasible, disable untrusted local code execution and enforce strict process isolation
- Ensure CPU microcode is current and Spectre v1 mitigations such as spectre_v1=on remain active at boot
- Use mandatory access control profiles such as SELinux or AppArmor to constrain processes that do not require prlimit64 access
# Verify running kernel version and confirm patch level
uname -r
# Debian: apply security updates including the patched kernel package
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-amd64
# Confirm Spectre v1 mitigation status
cat /sys/devices/system/cpu/vulnerabilities/spectre_v1
# Reboot to load the patched kernel
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
