CVE-2022-49610

Summary

In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Prevent RSB underflow before vmenter

On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter.

Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns.

For maximum paranoia, don't allow any returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter.

[ bp: Fix 32-bit build. ]

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxd28b387fb74da95d69d2615732f50cceb38e9a4d < afd743f6dde87296c6f3414706964c491bb85862affected
LinuxLinuxd28b387fb74da95d69d2615732f50cceb38e9a4d < 07853adc29a058c5fd143c14e5ac528448a72ed9affected
LinuxLinux44491a23b73789c0a914af4ea55ccf8968adf90baffected
LinuxLinuxfc6aae9f407810cb153a9133c28735871f9f0a16affected
LinuxLinux3.16.57 < 3.17affected
LinuxLinux4.4.168 < 4.5affected
LinuxLinux4.16affected
LinuxLinux0 < 4.16unaffected
LinuxLinux5.18.14 <= 5.18.*unaffected
LinuxLinux5.19 <= *unaffected

Weaknesses

References