medium
5.6
Advisory Published
CVE Published
Updated

CVE-2022-23960

First published: Tue Mar 08 2022(Updated: )

A new cache speculation vulnerability known as Branch History Injection (BHI) or Spectre-BHB was found. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's own hardware context. Once that occurs, speculation caused by mispredicted branches can be used to cause cache allocation, which can then be used to infer information that should not be accessible.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
redhat/kernel<0:4.18.0-425.3.1.el8
0:4.18.0-425.3.1.el8
debian/linux
5.10.223-1
5.10.226-1
6.1.123-1
6.1.128-1
6.12.12-1
6.12.13-1
Android
All of
Xen xen-unstable
Any of
Arm Cortex-A57 Firmware
Arm Cortex-A65 Firmware
Arm Cortex-A65AE Firmware
Arm Cortex-A710 Firmware
Arm Cortex-A72
ARM Cortex-A73 Firmware
Arm Cortex-A75
Arm Cortex-A76 Firmware
Arm Cortex-A76AE Firmware
Arm Cortex-A77 Firmware
ARM Cortex-A78 Firmware
Arm Cortex-A78AE Firmware
Arm Cortex-R7 Firmware
ARM Cortex-R8
Arm Cortex-X1
Arm Cortex-X2 Firmware
Arm Neoverse E1 Firmware
Arm Neoverse-V1 Firmware
Arm Neoverse N1
Arm Neoverse N2
All of
Arm Cortex-R7
Arm Cortex-R7 Firmware
All of
ARM Cortex-R8
ARM Cortex-R8
All of
Arm Cortex-A57
Arm Cortex-A57 Firmware
All of
Arm Cortex-A65 Firmware
Arm Cortex-A65 Firmware
All of
Arm Cortex-A65AE Firmware
Arm Cortex-A65AE Firmware
All of
Arm Cortex-A710 Firmware
Arm Cortex-A710 Firmware
All of
ARM Cortex-A72 Firmware
Arm Cortex-A72
All of
ARM Cortex-A73 Firmware
ARM Cortex-A73 Firmware
All of
Arm Cortex-A75 Firmware
Arm Cortex-A75
All of
Arm Cortex-A76 Firmware
Arm Cortex-A76 Firmware
All of
Arm Cortex-A76AE Firmware
Arm Cortex-A76AE Firmware
All of
Arm Cortex-A77 Firmware
Arm Cortex-A77 Firmware
All of
ARM Cortex-A78 Firmware
ARM Cortex-A78 Firmware
All of
Arm Cortex-A78AE Firmware
Arm Cortex-A78AE Firmware
All of
Arm Cortex-X1
Arm Cortex-X1
All of
Arm Cortex-X2 Firmware
Arm Cortex-X2 Firmware
All of
Arm Neoverse E1 Firmware
Arm Neoverse E1 Firmware
All of
Arm Neoverse v1
Arm Neoverse-V1 Firmware
All of
Arm Neoverse N1
Arm Neoverse N1
All of
Arm Neoverse N2
Arm Neoverse N2
Debian=9.0
Debian=10.0
Xen xen-unstable
Arm Cortex-A57 Firmware
Arm Cortex-A65 Firmware
Arm Cortex-A65AE Firmware
Arm Cortex-A710 Firmware
Arm Cortex-A72
ARM Cortex-A73 Firmware
Arm Cortex-A75
Arm Cortex-A76 Firmware
Arm Cortex-A76AE Firmware
Arm Cortex-A77 Firmware
ARM Cortex-A78 Firmware
Arm Cortex-A78AE Firmware
Arm Cortex-R7 Firmware
ARM Cortex-R8
Arm Cortex-X1
Arm Cortex-X2 Firmware
Arm Neoverse E1 Firmware
Arm Neoverse-V1 Firmware
Arm Neoverse N1
Arm Neoverse N2
Arm Cortex-R7
ARM Cortex-R8
Arm Cortex-A57
Arm Cortex-A65 Firmware
Arm Cortex-A65AE Firmware
Arm Cortex-A710 Firmware
ARM Cortex-A72 Firmware
ARM Cortex-A73 Firmware
Arm Cortex-A75 Firmware
Arm Cortex-A76 Firmware
Arm Cortex-A76AE Firmware
Arm Cortex-A77 Firmware
ARM Cortex-A78 Firmware
Arm Cortex-A78AE Firmware
Arm Cortex-X1
Arm Cortex-X2 Firmware
Arm Neoverse E1 Firmware
Arm Neoverse v1
Arm Neoverse N1
Arm Neoverse N2

Remedy

Disabling unprivileged eBPF effectively mitigates the known attack vectors for exploiting intra-mode branch injections attacks. The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. For the Red Hat Enterprise Linux 7, the eBPF for unprivileged users is always disabled. For the Red Hat Enterprise Linux 8 to confirm the current state, inspect the sysctl with the command: # cat /proc/sys/kernel/unprivileged_bpf_disabled The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

Remedy

http://www.openwall.com/lists/oss-security/2022/03/18/2

Remedy

https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability

Remedy

To mitigate the primary known attack vector, disable unprivileged eBPF: $ sudo sysctl kernel.unprivileged_bpf_disabled=1 or $ sudo sysctl kernel.unprivileged_bpf_disabled=2

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2022-23960?

    CVE-2022-23960 is classified as a high-severity vulnerability due to its potential impact on sensitive data.

  • How do I fix CVE-2022-23960?

    To mitigate CVE-2022-23960, ensure that your system is updated to the latest kernel version that includes patches addressing the vulnerability.

  • Which systems are affected by CVE-2022-23960?

    CVE-2022-23960 affects multiple systems, including versions of Red Hat kernel, Google Android, and various Arm Cortex processors.

  • What type of vulnerability is CVE-2022-23960?

    CVE-2022-23960 is a cache speculation vulnerability categorized under the Spectre family, which utilizes branch history manipulation.

  • Is CVE-2022-23960 a confirmed exploitation?

    As of now, there are no confirmed cases of exploitation specifically targeting CVE-2022-23960 in the wild.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203