CVE-2022-2196: Speculative execution attacks in KVM VMX
A flaw was found in the KVM's Intel nested virtualization feature (nVMX). Since L1 and L2 shared branch prediction modes (guest-user and guest-kernel), KVM did not protect indirect branches in L1 from steering by a malicious agent in L2. This could allow a malicious nested guest to carry out Spectre v2 attacks against L1 due to a missing IBPB at VM-exit time.
Other sources
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or applying the relevant stable backports (v5.4.233, v5.10.170, v5.15.96, v6.1.14).
— MITRE
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a
Since L1 and L2 shared branch prediction modes (guest-user and guest-kernel), KVM did not protect indirect branches in L1 from steering by a malicious agent in L2. This could allow a malicious L2 to carry out Spectre v2 attacks against L1 due to missing IBPB at VM-exit time.
Upstream patch & commit: https://lore.kernel.org/all/20221019213620.1953281-3-jmattson@google.com/ https://github.com/torvalds/linux/commit/2e7eab81425ad6c875f2ed47c0ce01e78afc38a5
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.rt7.274.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-477.10.1.el8_8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.el9_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.4.233 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.10.170 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.96 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.1.14 - Configuration
Mitigate by disabling Intel nested virtualization: unload the module and reload with nested=0 (e.g., `modprobe -r kvm_intel` then `modprobe kvm_intel nested=0`).
Linux KVM Intel nested virtualization (nVMX) / kvm_intel module nested = 0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-2196?
CVE-2022-2196 has been classified as a high severity vulnerability due to its potential exploitation by a nested malicious guest.
How do I fix CVE-2022-2196?
To fix CVE-2022-2196, you should update to the latest kernel versions specified: 0:4.18.0-477.10.1.rt7.274.el8_8, 0:4.18.0-477.10.1.el8_8, 0:5.14.0-284.11.1.el9_2, or 6.2.
What systems are affected by CVE-2022-2196?
CVE-2022-2196 affects multiple versions of the Linux Kernel and specifically those utilized in Red Hat kernel and Debian Linux packages.
What is the exploitability of CVE-2022-2196?
CVE-2022-2196 can be exploited by a nested guest to manipulate branches in a host system, potentially allowing escalation of privileges.
Is there a known workaround for CVE-2022-2196?
There are no known workarounds for CVE-2022-2196; updating to a secure version is the only reliable solution.