Improper Cross-boundary Removal of Sensitive Data Affecting ocfs2-kmp-default package, versions <5.14.21-150400.24.66.1


Severity

Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.04% (11th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES154-OCFS2KMPDEFAULT-5742609
  • published28 Jun 2023
  • disclosed27 Jun 2023

Introduced: 27 Jun 2023

CVE-2023-3006  (opens in a new tab)
CWE-212  (opens in a new tab)

How to fix?

Upgrade SLES:15.4 ocfs2-kmp-default to version 5.14.21-150400.24.66.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ocfs2-kmp-default package and not the ocfs2-kmp-default package as distributed by SLES. See How to fix? for SLES:15.4 relevant fixed versions and status.

A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.

CVSS Scores

version 3.1