CVE-2022-29900: Infoleak
A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.
Other sources
AMD: CVE-2022-29900 AMD CPU Branch Type Confusion
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.80.1.rt56.1225.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.80.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.32.1.rt7.189.el8_6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.32.1.el8_6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.36.1.el9_0 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.36.1.rt21.108.el9_0 - Upgrade
Upgrade
alpine/xento a version that resolves this vulnerability.Fixed in 4.14.5-r4 - Upgrade
Upgrade
alpine/xento a version that resolves this vulnerability.Fixed in 4.15.3-r1 - Upgrade
Upgrade
alpine/xento a version that resolves this vulnerability.Fixed in 4.16.1-r4 - Upgrade
Upgrade
alpine/xento a version that resolves this vulnerability.Fixed in 4.16.1-r5 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.18.14-1 - Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.16.2-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.17.5+72-g01140da4e8-1Fixed in 4.17.7+13-g2445b30a44-0+deb12u1Fixed in 4.20.3+127-gc42374a105-0+deb13u1Fixed in 4.20.4+63-g7abfd2bce2-0+deb13u1Fixed in 4.20.4+39-gf1e1321c87-1Fixed in 4.20.4+63-g7abfd2bce2-1 - Upgrade
Upgrade
ubuntu/linux-dell300xto a version that resolves this vulnerability.Fixed in 4.15.0-1060.65 - Upgrade
Upgrade
ubuntu/linux-raspi2to a version that resolves this vulnerability.Fixed in 4.15.0-1127.135 - Upgrade
Upgrade
ubuntu/linux-snapdragonto a version that resolves this vulnerability.Fixed in 4.15.0-1145.155 - Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1017.21~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1017.20~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1016.21~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gke-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1014.17~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-46.49~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1015.20~20.04.2 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-46.49~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1016.20~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1017.19~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.123~20.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-46.49 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1017.21 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1017.20 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1016.21 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1014.17 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1002.4 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1012.14 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1013.17 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1016.19 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-46.49 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1016.20 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.15.0-1013.15 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 5.15.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1019.19
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-29900?
CVE-2022-29900 has been classified as a high severity vulnerability due to its potential for arbitrary speculative code execution.
How do I fix CVE-2022-29900?
To fix CVE-2022-29900, you should update to the respective patched kernel versions provided by your operating system vendor.
What systems are affected by CVE-2022-29900?
CVE-2022-29900 affects various AMD processors and specific Linux kernel versions, primarily on systems using Red Hat and similar distributions.
Can CVE-2022-29900 be exploited remotely?
CVE-2022-29900 requires local access to the vulnerable system; however, it can lead to severe consequences, making it critical to apply mitigations.
What is the nature of the CVE-2022-29900 vulnerability?
CVE-2022-29900 is a flaw in AMD CPUs that involves mis-trained branch predictions, potentially allowing an attacker to execute arbitrary code speculatively.