Back
CVE-2022-2196
Speculative execution attacks in KVM VMX
Medium5.8EPSS 0.35%
- Published
- Updated
- Reserved
- Assigned by
Description
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or applying the relevant stable backports (v5.4.233, v5.10.170, v5.15.96, v6.1.14).
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GoogleCNA (assigner) | 3.1 | Medium5.8 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.35% · top 71% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.
Weakness
Affected products
- affected 64b8f33b2e1e687d465b5cb382e7bec495f1e026 – < f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b
- affected e089a83fbc55b8057f332c00f125acaa02b08ef7 – < 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5
- affected 02a3868d18fe639363f1cea6e6d7914513198e43 – < 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5
- affected 5c911beff20aa8639e7a1f28988736c13e03ed54 – < 1b0cafaae8884726c597caded50af185ffc13349
- affected 5c911beff20aa8639e7a1f28988736c13e03ed54 – < 6b539a7dbb49250f92515c2ba60aea239efc9e35
- affected 5c911beff20aa8639e7a1f28988736c13e03ed54 – < 63fada296062e91ad9f871970d4e7f19e21a6a15
- affected 5c911beff20aa8639e7a1f28988736c13e03ed54 – < 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5
- affected 5.4.47 – < 5.4.233
- affected 5.6.19 – < 5.7.0
- affected 5.7.3 – < 5.8.0
- affected 5.8.0 – < 5.10.170
- affected 5.11.0 – < 5.15.96
- affected 5.16.0 – < 6.1.14
- unaffected 6.2.0
References (8)
- https://kernel.dance/#2e7eab81425a (opens in a new tab)x_transferred
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 (opens in a new tab)x_transferred
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6b539a7dbb49250f92515c2ba60aea239efc9e35 (opens in a new tab)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b0cafaae8884726c597caded50af185ffc13349 (opens in a new tab)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b (opens in a new tab)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=63fada296062e91ad9f871970d4e7f19e21a6a15 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20230223-0002/ (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-2196)Record last updated .