CVE-2023-0045

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set  function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall.  The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit a664ec9158eeddd75121d39c9a0758016097fa96

• CWE-610
• CWE-610

• https://git.kernel.org/tip/a664ec9158eeddd75121d39c9a0758016097fa96Mailing List, Patch
• https://github.com/google/security-research/security/advisories/GHSA-9x5g-vmxf-4qj8Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/05/msg00005.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/05/msg00006.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230714-0001/Third Party Advisory
• https://git.kernel.org/tip/a664ec9158eeddd75121d39c9a0758016097fa96Mailing List, Patch
• https://github.com/google/security-research/security/advisories/GHSA-9x5g-vmxf-4qj8Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/05/msg00005.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/05/msg00006.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20230714-0001/Third Party Advisory

Published

Apr 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-0039Rejected reason: Duplicate. Please use CVE-2022-4060 instead…
• CVE-2023-0040Versions of Async HTTP Client prior to 1.13.2 are vulnerable…7.5
• CVE-2023-0041IBM Security Guardium 11.5 could allow a user to take over a…8.8
• CVE-2023-0042An issue has been discovered in GitLab CE/EE affecting all v…6.1
• CVE-2023-0043The Custom Add User WordPress plugin through 2.0.2 does not …6.1
• CVE-2023-0044If the Quarkus Form Authentication session cookie Path attri…6.1
• CVE-2023-0046Improper Restriction of Names for Files and Other Resources …7.2
• CVE-2023-0047Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-0048Code Injection in GitHub repository lirantal/daloradius prio…8.8
• CVE-2023-0049Out-of-bounds Read in GitHub repository vim/vim prior to 9.0…7.8
• CVE-2023-0050An issue has been discovered in GitLab affecting all version…5.4
• CVE-2023-0051Heap-based Buffer Overflow in GitHub repository vim/vim prio…7.8