Lucene search

K
redhatcveRedhat.comRH:CVE-2022-27672
HistoryMar 02, 2023 - 12:29 p.m.

CVE-2022-27672

2023-03-0212:29:59
redhat.com
access.redhat.com
19

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:H/Au:S/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

8.2%

A flaw was found in HW. When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch, potentially resulting in information disclosure.

Mitigation

The current mitigations for spectre V4 (or spectre_v2) should mitigate this flaw, no additional steps will need to be taken.

In more details, according to the article
<https://kernel.org/doc/html//next/admin-guide/hw-vuln/cross-thread-rsb.html&gt;

Two mitigations are needed:

  1. Stuff the RSB during context switch which is already being done in RHEL8/RHEL9 as long as the spectre_v2 mitigation is active.
  2. For KVM, the mitigation for the KVM_CAP_X86_DISABLE_EXITS capability can be turned on using the boolean module parameter mitigate_smt_rsb, e.g. vm.mitigate_smt_rsb=1.

The command to check if mitigation is active:
cat /sys/devices/system/cpu/vulnerabilities/spectre_v2

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:H/Au:S/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

8.2%