CVE-2022-2196
Description
Important: kernel security, bug fix, and enhancement update
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Description kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks Red Hat statement Red Hat currently provides the nested virtualization feature as a Technology Preview. Nested virtualization is therefore unsupported for production use. For more information please refer to https://access.redhat.com/solutions/21101 and…
Description
kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks
Red Hat statement
Red Hat currently provides the nested virtualization feature as a Technology Preview. Nested virtualization is therefore unsupported for production use. For more information please refer to https://access.redhat.com/solutions/21101 and https://access.redhat.com/support/offerings/techpreview.
CVSS v3: 5.6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | kernel-rt-0:4.18.0-477.10.1.rt7.274.el8_8 | RHSA-2023:2736 | 2023-05-16T00:00:00Z |
| Red Hat Enterprise Linux 8 | kernel-0:4.18.0-477.10.1.el8_8 | RHSA-2023:2951 | 2023-05-16T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Extended Update Support | kernel-0:4.18.0-372.93.1.el8_6 | RHSA-2024:0930 | 2024-02-21T00:00:00Z |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-284.11.1.el9_2 | RHSA-2023:2458 | 2023-05-09T00:00:00Z |
| Red Hat Enterprise Linux 9 | kernel-rt-0:5.14.0-284.11.1.rt14.296.el9_2 | RHSA-2023:2148 | 2023-05-09T00:00:00Z |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-284.11.1.el9_2 | RHSA-2023:2458 | 2023-05-09T00:00:00Z |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | kernel-0:4.18.0-372.93.1.el8_6 | RHSA-2024:0930 | 2024-02-21T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Out of support scope |
| Red Hat Enterprise Linux 7 | kernel | Out of support scope |
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope |
Apply commands
yum update -y kernel-rt
# or:
dnf upgrade -y kernel-rtOS impact
SUSE Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | — |
AlmaLinux Fixed 2 releases
| Version | Status | Fixed in |
|---|---|---|
| 9 | Fixed | kernel-devel-matched-5.14.0-284.11.1.el9_2.aarch64.rpm |
| 8 | Fixed | kernel-rt-debug-core-4.18.0-477.10.1.rt7.274.el8_8.x86_64.rpm |
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 6.1.15-1 |
| sid | Fixed | 6.1.15-1 |
| forky | Fixed | 6.1.15-1 |
| bullseye | Fixed | 5.10.178-1 |
| bookworm | Fixed | 6.1.15-1 |
Red Hat Fixed 2 releases
| Version | Status | Fixed in |
|---|---|---|
| 9 | Fixed | — |
| 8 | Fixed | — |
References
- https://access.redhat.com/errata/RHSA-2023:2148
- https://access.redhat.com/errata/RHSA-2023:2458
- https://www.suse.com/security/cve/CVE-2022-2196.html
- https://security-tracker.debian.org/tracker/CVE-2022-2196
- https://access.redhat.com/errata/RHSA-2023:2736
- https://bugzilla.redhat.com/2055499
- https://bugzilla.redhat.com/2061703
- https://bugzilla.redhat.com/2078466
- https://bugzilla.redhat.com/2084125
- https://bugzilla.redhat.com/2085300
- https://bugzilla.redhat.com/2090723
- https://bugzilla.redhat.com/2108691
- https://bugzilla.redhat.com/2108696
- https://bugzilla.redhat.com/2114937
- https://bugzilla.redhat.com/2122228
- https://bugzilla.redhat.com/2122960
- https://bugzilla.redhat.com/2123056
- https://bugzilla.redhat.com/2124788
- https://bugzilla.redhat.com/2127985
- https://bugzilla.redhat.com/2130141
- https://bugzilla.redhat.com/2133483
- https://bugzilla.redhat.com/2134377
- https://bugzilla.redhat.com/2134451
- https://bugzilla.redhat.com/2134506
- https://bugzilla.redhat.com/2134517
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.