« Volver al listado

CVE-2022-49610

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Prevent RSB underflow before vmenter

On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter.

Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns.

For maximum paranoia, don't allow *any* returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter.

Detalles técnicos trazas, registros y código del informe original
  [ bp: Fix 32-bit build. ]

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-49610",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d28b387fb74da95d69d2615732f50cceb38e9a4d",
              "lessThan": "afd743f6dde87296c6f3414706964c491bb85862",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d28b387fb74da95d69d2615732f50cceb38e9a4d",
              "lessThan": "07853adc29a058c5fd143c14e5ac528448a72ed9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "44491a23b73789c0a914af4ea55ccf8968adf90b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fc6aae9f407810cb153a9133c28735871f9f0a16",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3.16.57",
              "lessThan": "3.17",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.4.168",
              "lessThan": "4.5",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "arch/x86/kernel/asm-offsets.c",
            "arch/x86/kernel/cpu/bugs.c",
            "arch/x86/kvm/vmx/capabilities.h",
            "arch/x86/kvm/vmx/vmenter.S",
            "arch/x86/kvm/vmx/vmx.c",
            "arch/x86/kvm/vmx/vmx.h",
            "arch/x86/kvm/vmx/vmx_ops.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.18.14",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/x86/kernel/asm-offsets.c",
            "arch/x86/kernel/cpu/bugs.c",
            "arch/x86/kvm/vmx/capabilities.h",
            "arch/x86/kvm/vmx/vmenter.S",
            "arch/x86/kvm/vmx/vmx.c",
            "arch/x86/kvm/vmx/vmx.h",
            "arch/x86/kvm/vmx/vmx_ops.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-02-26T07:01:36.463",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/07853adc29a058c5fd143c14e5ac528448a72ed9",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/afd743f6dde87296c6f3414706964c491bb85862",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Prevent RSB underflow before vmenter\n\nOn VMX, there are some balanced returns between the time the guest's\nSPEC_CTRL value is written, and the vmenter.\n\nBalanced returns (matched by a preceding call) are usually ok, but it's\nat least theoretically possible an NMI with a deep call stack could\nempty the RSB before one of the returns.\n\nFor maximum paranoia, don't allow *any* returns (balanced or otherwise)\nbetween the SPEC_CTRL write and the vmenter.\n\n  [ bp: Fix 32-bit build. ]"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: VMX: Evitar el desbordamiento de RSB antes de vmenter En VMX, hay algunos retornos equilibrados entre el momento en que se escribe el valor SPEC_CTRL del invitado y el vmenter. Los retornos equilibrados (que coinciden con una llamada anterior) suelen ser correctos, pero al menos es teóricamente posible que un NMI con una pila de llamadas profunda pueda vaciar el RSB antes de uno de los retornos. Para máxima paranoia, no permita *ningún* retorno (equilibrado o de otro tipo) entre la escritura de SPEC_CTRL y el vmenter. [ bp: Arreglar compilación de 32 bits. ]"
    }
  ],
  "lastModified": "2026-06-17T05:18:37.410",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6958CFC-F1AB-4F94-BDC7-685D623EE2B4",
              "versionEndExcluding": "5.18.14"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8C30C2D-F82D-4D37-AB48-D76ABFBD5377"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF8547FC-C849-4F1B-804B-A93AE2F04A92"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3068028-F453-4A1C-B80F-3F5609ACEF60"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E9C0DB0-D349-489F-A3D6-B77214E93A8A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A0DE3B7-0FFB-45AA-9BD6-19870CA7C6FD"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00AE778B-BAEE-49EB-9F84-003B73D7862A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}