CVE-2022-2196

HighCVSS 8.8/10Last modified Aug 7, 2026

Description

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or applying the relevant stable backports (v5.4.233, v5.10.170, v5.15.96, v6.1.14).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1188

Affected software

No affected versions have been published.

Timeline

Published
Jan 9, 2023
Last modified
Aug 7, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-219606.8Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityCVE-2022-219616.8Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityCVE-2022-219626.8Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityCVE-2022-219636.8Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityCVE-2022-219645.5Remote Desktop Licensing Diagnoser Information Disclosure VulnerabilityCVE-2022-219657.5Microsoft Teams Denial of Service VulnerabilityCVE-2022-219677.0Xbox Live Auth Manager for Windows Elevation of Privilege VulnerabilityCVE-2022-219684.3Microsoft SharePoint Server Security Feature Bypass VulnerabilityCVE-2022-219699.0Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2022-21979.8By using a specific credential string, an attacker with network access to the device’s web interface could circumvent the authentication schCVE-2022-219706.1Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2022-219717.8Windows Runtime Remote Code Execution Vulnerability
CVE-2022-2196: High severity, CVSS 8.8 | Vulnix