RCE in Linux Kernel
CVE-2022-2196
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or applying the relevant stable backports (v5.4.233, v5.10.170, v5.15.96, v6.1.14).
EPSS: 0.003 (20.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L.
Affected products
- Linux Kernel — versions 6.2.0, 5.8.0, 0
- Linux Linux_kernel
- Debian Debian_linux — versions 10.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve-coordination@google.com (Patch, Third Party Advisory)
- cve-coordination@google.com (Patch, Mailing List, Vendor Advisory)
- cve-coordination@google.com (Mailing List, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108
- cve-coordination@google.com
- cve-coordination@google.com
- cve-coordination@google.com
- cve-coordination@google.com
Frequently asked questions
- What is CVE-2022-2196?
- CVE-2022-2196 is a medium-severity vulnerability in Linux Kernel, classified under Initialization of a Resource with an Insecure Default. CVSS score: 5.8/10. Published 2023-01-09.
- How severe is CVE-2022-2196?
- Medium severity. CVSS v3 base score is 5.8 out of 10.
- Is CVE-2022-2196 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.