Medium severity · published Jun 15, 2022
CVE-2022-21125
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access
5.5
CVSS
6.5%
EPSS
No
On KEV
Description
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
ESXi · VMware
7.0; 7.0; 7.0; 7.0; 7.0; 7.0; +7 more · source: NVD
IP
Intel(R) Processors ·
See references · source: vendor
DL
Debian Linux · Debian
9.0; 10.0; 11.0 · source: NVD
FE
Fedora · Fedoraproject
35; 36 · source: NVD
SD
Sgx Dcap · Intel
before 1.14.100.3; before 1.14.100.3 · source: NVD
SP
Sgx Psw · Intel
before 2.16.100.3; before 2.17.100.3 · source: NVD
SS
Sgx Sdk · Intel
before 2.16.100.3; before 2.17.100.3 · source: NVD
XE
Xen · Xen
All versions, or not specified · source: NVD
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
before V1.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-21125
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-21125
Mailing List
http://www.openwall.com/lists/oss-security/2022/06/16/1
Patch
http://xenbits.xen.org/xsa/advisory-404.html
Mailing List
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHTEW3RXU2GW6S3RCPQG4VNCZGI3TOSV/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MCVOMHBQRH4KP7IN6U24CW7F2D2L5KBS/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/
More from ESXi
9.8
CVE-2020-3992
VMware ESXi OpenSLP Use-After-Free Vulnerability
9.8
CVE-2019-5544
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
8.2
CVE-2025-22225
VMware ESXi Arbitrary Write Vulnerability
8.2
CVE-2025-22224
VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
7.8
CVE-2010-3904
Linux Kernel Improper Input Validation Vulnerability