CVE-2023-52746

What it actually does

Missing array_index_nospec() on a user-controlled nla_type value used as an array index in xfrm_xlate32_attr() creates a Spectre v1 gadget that can speculatively read kernel memory beyond intended bounds.

Why it matters to the business

Attackers may be able to read sensitive kernel memory contents, increasing risk of credential or key exposure on systems running affected kernel or OVN packages; widespread Linux kernel deployment amplifies potential blast radius.

How an attack unfolds

An attacker sends a crafted netlink message containing an out-of-range XFRMA attribute type to the xfrm subsystem; the kernel performs a bounds check that is bypassed under speculative execution, allowing the type value to index into kernel memory and leak contents via a side channel such as cache timing.

How to fix it

Apply kernel patch a893cc644812728e86e9aff517fd5698812ecef0 or later; for OVN packages upgrade to 22.03.3-0ubuntu0.22.04.1 (Ubuntu 22.04), 23.03.1-1~deb12u1 (Debian 12), 23.09.0-1 (Debian 13), or equivalent fixed commit 9a3f7ed905e525ebdcb14541e775211cbb0203bd.

How to confirm the fix worked

Confirm presence of array_index_nospec() call inside xfrm_xlate32_attr() after applying updates; verify package versions match the listed fixed releases and test that out-of-range attribute types now safely return -EOPNOTSUPP without speculative indexing.

Typical attack path

1. Send malicious netlink attribute via xfrm netlink socket
2. Supply type value exceeding XFRMA_MAX
3. Trigger speculative execution of array access using the un-sanitized index
4. Measure side-channel effects to reconstruct leaked kernel memory bytes

How to detect it

Monitor netlink audit logs or system call traces for unusual xfrm attribute submissions; post-exploitation detection is difficult because the flaw relies on speculative execution with no persistent artifacts or error logs generated on successful leaks.

What your security team should do

• Prioritize kernel and OVN package updates within normal change windows given low EPSS and absence from KEV
• Include the xfrm compat path in future kernel hardening and Spectre mitigation reviews
• Track upstream stable kernel releases for any follow-on fixes