CVE-2022-2196

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or applying the relevant stable backports (v5.4.233, v5.10.170, v5.15.96, v6.1.14).

Database specific

{
    "cna_assigner":  "Google",
    "cwe_ids":  [
        "CWE-1188"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2196.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "5.4.47"
                        },
                        {
                            "fixed":  "5.4.233"
                        },
                        {
                            "introduced":  "5.6.19"
                        },
                        {
                            "fixed":  "5.7.0"
                        },
                        {
                            "introduced":  "5.7.3"
                        },
                        {
                            "fixed":  "5.8.0"
                        },
                        {
                            "introduced":  "5.8.0"
                        },
                        {
                            "fixed":  "5.10.170"
                        },
                        {
                            "introduced":  "5.11.0"
                        },
                        {
                            "fixed":  "5.15.96"
                        },
                        {
                            "introduced":  "5.16.0"
                        },
                        {
                            "fixed":  "6.1.14"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

Affected ranges

Type

GIT

Repo

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

Events

Introduced

64b8f33b2e1e687d465b5cb382e7bec495f1e026

Fixed

f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b

Introduced

e089a83fbc55b8057f332c00f125acaa02b08ef7

Fixed

2e7eab81425ad6c875f2ed47c0ce01e78afc38a5

Introduced

02a3868d18fe639363f1cea6e6d7914513198e43

Fixed

2e7eab81425ad6c875f2ed47c0ce01e78afc38a5

Introduced

5c911beff20aa8639e7a1f28988736c13e03ed54

Fixed

1b0cafaae8884726c597caded50af185ffc13349

Fixed

6b539a7dbb49250f92515c2ba60aea239efc9e35

Fixed

63fada296062e91ad9f871970d4e7f19e21a6a15

Fixed

2e7eab81425ad6c875f2ed47c0ce01e78afc38a5

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "64b8f33b2e1e687d465b5cb382e7bec495f1e026"
                },
                {
                    "fixed":  "f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "e089a83fbc55b8057f332c00f125acaa02b08ef7"
                },
                {
                    "fixed":  "2e7eab81425ad6c875f2ed47c0ce01e78afc38a5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "02a3868d18fe639363f1cea6e6d7914513198e43"
                },
                {
                    "fixed":  "2e7eab81425ad6c875f2ed47c0ce01e78afc38a5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "5c911beff20aa8639e7a1f28988736c13e03ed54"
                },
                {
                    "fixed":  "1b0cafaae8884726c597caded50af185ffc13349"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "5c911beff20aa8639e7a1f28988736c13e03ed54"
                },
                {
                    "fixed":  "6b539a7dbb49250f92515c2ba60aea239efc9e35"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "5c911beff20aa8639e7a1f28988736c13e03ed54"
                },
                {
                    "fixed":  "63fada296062e91ad9f871970d4e7f19e21a6a15"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "5c911beff20aa8639e7a1f28988736c13e03ed54"
                },
                {
                    "fixed":  "2e7eab81425ad6c875f2ed47c0ce01e78afc38a5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "2e7eab81425ad6c875f2ed47c0ce01e78afc38a5"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-2196.json"