Description (CNA)
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or applying the relevant stable backports (v5.4.233, v5.10.170, v5.15.96, v6.1.14).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux Kernel | affected 64b8f33b2e1e687d465b5cb382e7bec495f1e026 before f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b; affected e089a83fbc55b8057f332c00f125acaa02b08ef7 before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5; affected 02a3868d18fe639363f1cea6e6d7914513198e43 before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5; affected 5c911beff20aa8639e7a1f28988736c13e03ed54 before 1b0cafaae8884726c597caded50af185ffc13349; affected 5c911beff20aa8639e7a1f28988736c13e03ed54 before 6b539a7dbb49250f92515c2ba60aea239efc9e35; affected 5c911beff20aa8639e7a1f28988736c13e03ed54 before 63fada296062e91ad9f871970d4e7f19e21a6a15; affected 5c911beff20aa8639e7a1f28988736c13e03ed54 before 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5; affected 5.4.47 before 5.4.233; affected 5.6.19 before 5.7.0; affected 5.7.3 before 5.8.0; affected 5.8.0 before 5.10.170; affected 5.11.0 before 5.15.96; affected 5.16.0 before 6.1.14; unaffected 6.2.0 |
CWE
CWE-1188
References
- https://kernel.dance/#2e7eab81425a
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2e7eab81425ad6c875f2ed47c0ce01e78afc38a5
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6b539a7dbb49250f92515c2ba60aea239efc9e35
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b0cafaae8884726c597caded50af185ffc13349
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=63fada296062e91ad9f871970d4e7f19e21a6a15
- https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.