In the Linux kernel, the following vulnerability has been resolved:
KVM: VMX: Prevent RSB underflow before vmenter
On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter.
Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns.
For maximum paranoia, don't allow any returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter.
[ bp: Fix 32-bit build. ]
{ "vanir_signatures": [ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862", "digest": { "threshold": 0.9, "line_hashes": [ "302234885813613958568173580095751778748", "74424016116969006582518840537174002083", "159720248237560392984628979207752914911", "33219614472662598115347921722954161173" ] }, "id": "CVE-2022-49610-11b3fab8", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "target": { "file": "arch/x86/kvm/vmx/vmx_ops.h" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862", "digest": { "length": 3132.0, "function_hash": "181262052019410562322976267752778028130" }, "id": "CVE-2022-49610-29363848", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "target": { "function": "vmx_vcpu_run", "file": "arch/x86/kvm/vmx/vmx.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862", "digest": { "threshold": 0.9, "line_hashes": [ "257943817065012065794554432787267576778", "295905572913382848933459950817116094243", "209153283571951035322814859634227639248", "175701597456369944459294587759462069509", "43334486843913041335164243483992945702", "49722840482859372783819251133420214279", "159691622929496484025664138754434332096", "40954890949305034008653705907706334565" ] }, "id": "CVE-2022-49610-322eba5a", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "target": { "file": "arch/x86/kvm/vmx/vmx.h" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9", "digest": { "threshold": 0.9, "line_hashes": [ "305992800706980906925999528440498032973", "56369000712932768590679272705581706178", "8094670022696044542378022692699444206", "312640334306933498797876438725970892891" ] }, "id": "CVE-2022-49610-45621282", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "target": { "file": "arch/x86/kvm/vmx/capabilities.h" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9", "digest": { "threshold": 0.9, "line_hashes": [ "257943817065012065794554432787267576778", "295905572913382848933459950817116094243", "209153283571951035322814859634227639248", "175701597456369944459294587759462069509", "43334486843913041335164243483992945702", "49722840482859372783819251133420214279", "159691622929496484025664138754434332096", "40954890949305034008653705907706334565" ] }, "id": "CVE-2022-49610-45f4ee17", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "target": { "file": "arch/x86/kvm/vmx/vmx.h" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9", "digest": { "length": 3005.0, "function_hash": "84542645988460300420968069744533747538" }, "id": "CVE-2022-49610-674356b2", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "target": { "function": "common", "file": "arch/x86/kernel/asm-offsets.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9", "digest": { "length": 3132.0, "function_hash": "181262052019410562322976267752778028130" }, "id": "CVE-2022-49610-72fd1669", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "target": { "function": "vmx_vcpu_run", "file": "arch/x86/kvm/vmx/vmx.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862", "digest": { "threshold": 0.9, "line_hashes": [ "305992800706980906925999528440498032973", "56369000712932768590679272705581706178", "8094670022696044542378022692699444206", "312640334306933498797876438725970892891" ] }, "id": "CVE-2022-49610-8913730d", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "target": { "file": "arch/x86/kvm/vmx/capabilities.h" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9", "digest": { "threshold": 0.9, "line_hashes": [ "98253255455782704251654248453072307596", "225256394484397398429058292581410538771", "14125282753860562710482655249640053208", "219197269120243320046227251000953325515", "265341890446666886456803840658104124113", "179334629040812249807178418140123726458" ] }, "id": "CVE-2022-49610-8f8c7226", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "target": { "file": "arch/x86/kernel/asm-offsets.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862", "digest": { "threshold": 0.9, "line_hashes": [ "174324603829540330889503781805646369626", "81755253594585538960487034923675866181", "136919738902668993846494396108207095465", "332827311643803863797403891557188738085", "265341890446666886456803840658104124113", "179334629040812249807178418140123726458" ] }, "id": "CVE-2022-49610-97aeef31", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "target": { "file": "arch/x86/kernel/asm-offsets.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862", "digest": { "threshold": 0.9, "line_hashes": [ "241070121709703608458725793092682885807", "231525651683189789861792206511786238619", "111985930820921255648446107651231814635", "295736318084874431177623285228623821449" ] }, "id": "CVE-2022-49610-c89bdb06", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "target": { "file": "arch/x86/kvm/vmx/vmx.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862", "digest": { "length": 2283.0, "function_hash": "7778331930611371832552327262317518831" }, "id": "CVE-2022-49610-d3611290", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "target": { "function": "common", "file": "arch/x86/kernel/asm-offsets.c" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9", "digest": { "threshold": 0.9, "line_hashes": [ "302234885813613958568173580095751778748", "74424016116969006582518840537174002083", "159720248237560392984628979207752914911", "33219614472662598115347921722954161173" ] }, "id": "CVE-2022-49610-d8b8642d", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "target": { "file": "arch/x86/kvm/vmx/vmx_ops.h" } }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9", "digest": { "threshold": 0.9, "line_hashes": [ "241070121709703608458725793092682885807", "231525651683189789861792206511786238619", "111985930820921255648446107651231814635", "295736318084874431177623285228623821449" ] }, "id": "CVE-2022-49610-eaa666fd", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "target": { "file": "arch/x86/kvm/vmx/vmx.c" } } ] }