CVE-2022-23824

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
AMD	AMD Processors	Processor various

References

http://www.openwall.com/lists/oss-security/2022/11/10/2Mailing List, Mitigation, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTQMPJC5N6XJYQ232OZFLK47HVZNRBY3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
https://security.gentoo.org/glsa/202402-07
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1040Mitigation, Vendor Advisory
https://www.debian.org/security/2023/dsa-5378
http://www.openwall.com/lists/oss-security/2022/11/10/2Mailing List, Mitigation, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTQMPJC5N6XJYQ232OZFLK47HVZNRBY3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
https://security.gentoo.org/glsa/202402-07
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1040Mitigation, Vendor Advisory
https://www.debian.org/security/2023/dsa-5378

Timeline

Published: Nov 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-238256.5Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure CVE-2022-238261.8A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race conditi CVE-2022-238298.2A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native Syst CVE-2022-23836.1The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t CVE-2022-238305.3SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.CVE-2022-238317.5Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential Wind CVE-2022-238337.5An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to m CVE-2022-238358.1The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an appli CVE-2022-238377.5In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads th CVE-2022-23844.8The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users CVE-2022-238489.8In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerabil CVE-2022-238496.6The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication