CVE-2023-1637

Advisory lineage Upstream: 0 Downstream: 23
Modified
Published: 27 Mar 2023, 00:00
Last modified:19 Feb 2025, 21:06

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.01% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Mar 2023, 00:00
Published
Vulnerability first disclosed
19 Feb 2025, 21:06
Last Modified
Vulnerability information updated

Description

A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.01%• Percentile: 3%

Techniques & Countermeasures

  • CWE-226•Sensitive Information in Resource Not Removed Before Reuse

    The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

  • CWE-212•Improper Removal of Sensitive Information Before Storage or Transfer

    The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Affected Systems

  • linux•linux_kernel

    5.18:rc2

References (2)