CVE-2022-29901mediumCWE-200

CVE-2022-29901: medium-severity vulnerability in Intel Microprocessors

Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)

Published · Updated

Follow this CVE+ Monitor Intel Microprocessors+ Monitor linux

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.6epss 5.0%
In short

A vulnerability in Intel processors allows attackers to leak sensitive data from the computer's memory through a technique that exploits how processors handle return instructions. An unprivileged user can trigger this flaw to access confidential information like passwords or encryption keys.

Technical detail

This Spectre variant (Retbleed) bypasses retpoline mitigations on Intel microprocessors (generations 6-8) by hijacking return instructions to achieve speculative code execution. An unprivileged local attacker can leak arbitrary kernel or process memory by manipulating return address prediction under specific microarchitecture conditions, resulting in information disclosure.

Summary generated and translated by AI from the official description.
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
Intel · Intel Microprocessors