8.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.3 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:S/C:P/I:P/A:P
0.0004 Low
EPSS
Percentile
9.1%
A regression exists in the Linux Kernel within KVM: nVMX that allowed for
speculative execution attacks. L2 can carry out Spectre v2 attacks on L1
due to L1 thinking it doesn’t need retpolines or IBPB after running L2 due
to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code
execution can execute code on an indirect branch on the host machine. We
recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 20.04 | noarch | linux | < 5.4.0-146.163 | UNKNOWN |
ubuntu | 22.04 | noarch | linux | < 5.15.0-69.76 | UNKNOWN |
ubuntu | 22.10 | noarch | linux | < 5.19.0-38.39 | UNKNOWN |
ubuntu | 20.04 | noarch | linux-aws | < 5.4.0-1099.107 | UNKNOWN |
ubuntu | 22.04 | noarch | linux-aws | < 5.15.0-1033.37 | UNKNOWN |
ubuntu | 22.10 | noarch | linux-aws | < 5.19.0-1022.23 | UNKNOWN |
ubuntu | 20.04 | noarch | linux-aws-5.15 | < 5.15.0-1033.37~20.04.1 | UNKNOWN |
ubuntu | 18.04 | noarch | linux-aws-5.4 | < 5.4.0-1099.107~18.04.1 | UNKNOWN |
ubuntu | 20.04 | noarch | linux-azure | < 5.4.0-1105.111 | UNKNOWN |
ubuntu | 22.04 | noarch | linux-azure | < 5.15.0-1035.42 | UNKNOWN |
git.kernel.org/linus/2e7eab81425ad6c875f2ed47c0ce01e78afc38a5
launchpad.net/bugs/cve/CVE-2022-2196
nvd.nist.gov/vuln/detail/CVE-2022-2196
security-tracker.debian.org/tracker/CVE-2022-2196
ubuntu.com/security/notices/USN-5970-1
ubuntu.com/security/notices/USN-5976-1
ubuntu.com/security/notices/USN-5977-1
ubuntu.com/security/notices/USN-5978-1
ubuntu.com/security/notices/USN-5979-1
ubuntu.com/security/notices/USN-5980-1
ubuntu.com/security/notices/USN-5982-1
ubuntu.com/security/notices/USN-5985-1
ubuntu.com/security/notices/USN-5987-1
ubuntu.com/security/notices/USN-6004-1
ubuntu.com/security/notices/USN-6020-1
ubuntu.com/security/notices/USN-6151-1
www.cve.org/CVERecord?id=CVE-2022-2196
8.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.3 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:S/C:P/I:P/A:P
0.0004 Low
EPSS
Percentile
9.1%