Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
0

CVE-2022-29901

Disclosure Date: July 12, 2022 •
CVE-2022-29901 CVSS v3 Base Score: 6.5
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
6.5 Medium
Impact Score:
4
Exploitability Score:
2
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Changed
Confidentiality (C):
High
Integrity (I):
None
Availability (A):
None

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
Intel Microprocessors generations 6 to 8
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • debian,
  • fedoraproject,
  • intel,
  • vmware,
  • xen

Products

  • core i3-6100 firmware -,
  • core i3-6100e firmware -,
  • core i3-6100h firmware -,
  • core i3-6100t firmware -,
  • core i3-6100te firmware -,
  • core i3-6100u firmware -,
  • core i3-6102e firmware -,
  • core i3-6110u firmware -,
  • core i3-6120 firmware -,
  • core i3-6120t firmware -,
  • core i3-6167u firmware -,
  • core i3-6300 firmware -,
  • core i3-6300t firmware -,
  • core i3-6320 firmware -,
  • core i3-6320t firmware -,
  • core i3-8000 firmware -,
  • core i3-8000t firmware -,
  • core i3-8020 firmware -,
  • core i3-8100 firmware -,
  • core i3-8100h firmware -,
  • core i3-8100t firmware -,
  • core i3-8109u firmware -,
  • core i3-8120 firmware -,
  • core i3-8130u firmware -,
  • core i3-8145u firmware -,
  • core i3-8300 firmware -,
  • core i3-8300t firmware -,
  • core i3-8350k firmware -,
  • core i5-6200u firmware -,
  • core i5-6210u firmware -,
  • core i5-6260u firmware -,
  • core i5-6267u firmware -,
  • core i5-6287u firmware -,
  • core i5-6300hq firmware -,
  • core i5-6300u firmware -,
  • core i5-6310u firmware -,
  • core i5-6350hq firmware -,
  • core i5-6360u firmware -,
  • core i5-6400 firmware -,
  • core i5-6400t firmware -,
  • core i5-6440eq firmware -,
  • core i5-6440hq firmware -,
  • core i5-6442eq firmware -,
  • core i5-6500 firmware -,
  • core i5-6500t firmware -,
  • core i5-6500te firmware -,
  • core i5-6600 firmware -,
  • core i5-6600k firmware -,
  • core i5-6600t firmware -,
  • core i5-8200y firmware -,
  • core i5-8210y firmware -,
  • core i5-8250u firmware -,
  • core i5-8259u firmware -,
  • core i5-8265u firmware -,
  • core i5-8269u firmware -,
  • core i5-8300h firmware -,
  • core i5-8305g firmware -,
  • core i5-8310y firmware -,
  • core i5-8350u firmware -,
  • core i5-8365u firmware -,
  • core i5-8400 firmware -,
  • core i5-8400b firmware -,
  • core i5-8400h firmware -,
  • core i5-8400t firmware -,
  • core i5-8420 firmware -,
  • core i5-8420t firmware -,
  • core i5-8500 firmware -,
  • core i5-8500b firmware -,
  • core i5-8500t firmware -,
  • core i5-8550 firmware -,
  • core i5-8550u firmware -,
  • core i5-8600 firmware -,
  • core i5-8600k firmware -,
  • core i5-8600t firmware -,
  • core i5-8650 firmware -,
  • core i5-8650k firmware -,
  • core i7-6500u firmware -,
  • core i7-6510u firmware -,
  • core i7-6560u firmware -,
  • core i7-6567u firmware -,
  • core i7-6600u firmware -,
  • core i7-6650u firmware -,
  • core i7-6660u firmware -,
  • core i7-6700 firmware -,
  • core i7-6700hq firmware -,
  • core i7-6700k firmware -,
  • core i7-6700t firmware -,
  • core i7-6700te firmware -,
  • core i7-6770hq firmware -,
  • core i7-6820eq firmware -,
  • core i7-6820hk firmware -,
  • core i7-6820hq firmware -,
  • core i7-6822eq firmware -,
  • core i7-6870hq firmware -,
  • core i7-6920hq firmware -,
  • core i7-6970hq firmware -,
  • core i7-8500y firmware -,
  • core i7-8510y firmware -,
  • core i7-8550u firmware -,
  • core i7-8557u firmware -,
  • core i7-8559u firmware -,
  • core i7-8560u firmware -,
  • core i7-8565u firmware -,
  • core i7-8569u firmware -,
  • core i7-8650u firmware -,
  • core i7-8665u firmware -,
  • core i7-8670 firmware -,
  • core i7-8670t firmware -,
  • core i7-8700 firmware -,
  • core i7-8700b firmware -,
  • core i7-8700k firmware -,
  • core i7-8700t firmware -,
  • core i7-8705g firmware -,
  • core i7-8706g firmware -,
  • core i7-8709g firmware -,
  • core i7-8750h firmware -,
  • core i7-8750hf firmware -,
  • core i7-8809g firmware -,
  • core i7-8850h firmware -,
  • core i9-8950hk firmware -,
  • core m3-6y30 firmware -,
  • core m3-8100y firmware -,
  • core m5-6y54 firmware -,
  • core m5-6y57 firmware -,
  • core m7-6y75 firmware -,
  • debian linux 10.0,
  • debian linux 11.0,
  • esxi 7.0,
  • fedora 35,
  • fedora 36,
  • xen -

References

Canonical
CVE-2022-29901 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29901)
Advisory
https://comsec.ethz.ch/retbleed
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00702.html
[oss-security] 20220712 Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions (http://www.openwall.com/lists/oss-security/2022/07/12/2)
[oss-security] 20220712 Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions (http://www.openwall.com/lists/oss-security/2022/07/12/4)
[oss-security] 20220712 Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions (http://www.openwall.com/lists/oss-security/2022/07/12/5)
[oss-security] 20220713 Re: Xen Security Advisory 407 v1 (CVE-2022-23816,CVE-2022-23825,CVE-2022-29900) - Retbleed - arbitrary speculative code execution with return instructions (http://www.openwall.com/lists/oss-security/2022/07/13/1)
FEDORA-2022-c69ef9c1dd (https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M27MB3QFNIJV4EQQSXWARHP3OGX6CR6K/)
FEDORA-2022-8aab5b5cde (https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D4RW5FCIYFNCQOEFJEUIRW3DGYW7CWBG/)
DSA-5207 (https://www.debian.org/security/2022/dsa-5207)
[debian-lts-announce] 20220911 [SECURITY] [DLA 3102-1] linux-5.10 new package (https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html)
https://security.netapp.com/advisory/ntap-20221007-0007/
[debian-lts-announce] 20221223 [SECURITY] [DLA 3245-1] linux security update (https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html)
GLSA-202402-07 (https://security.gentoo.org/glsa/202402-07)
Miscellaneous
https://www.secpod.com/blog/retbleed-intel-and-amd-processor-information-disclosure-vulnerability/

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis