Medium severity · published Jul 12, 2022
CVE-2022-29901
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data
6.5
CVSS
5%
EPSS
No
On KEV
Description
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)5.0% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Core I3-6100 Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6100e Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6100h Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6100t Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6100te Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6100u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6102e Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6110u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6120 Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6120t Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6167u Firmware · Intel
All versions, or not specified · source: NVD
CI
Core I3-6300 Firmware · Intel
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29901
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29901
www.openwall.com
http://www.openwall.com/lists/oss-security/2022/07/12/2
www.openwall.com
http://www.openwall.com/lists/oss-security/2022/07/12/4
www.openwall.com
http://www.openwall.com/lists/oss-security/2022/07/12/5
www.openwall.com
http://www.openwall.com/lists/oss-security/2022/07/13/1
comsec.ethz.ch
https://comsec.ethz.ch/retbleed
lists.debian.org
https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html
More from Core I3-6100 Firmware
6.7
CVE-2019-11157
Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure…
6.5
CVE-2018-12207
Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of…
5.5
CVE-2022-21180
Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially cause a denial of service via local access
2.4
CVE-2022-0005
Sensitive information accessible by physical probing of JTAG interface for some Intel(R) Processors with SGX may allow an unprivileged user to potentially enable information…