CVE-2022-29900 — Improper Removal of Sensitive Information Before Storage or Transfer in AMD Processors
Severity
6.5MEDIUMNVD
EPSS
1.4%
top 19.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 12
Latest updateApr 11
Description
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NExploitability: 2.0 | Impact: 4.0
Affected Packages3 packages
Also affects: Debian Linux 11.0, Fedora 35, 36
🔴Vulnerability Details
3GHSA▶
GHSA-f3p5-98fc-2gxr: AMD microprocessor families 15h to 18h are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak a↗2022-07-13
CVEList▶
CVE-2022-29900: Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent condit↗2022-07-12
OSV▶
CVE-2022-29900: Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent condit↗2022-07-12