CVE-2022-29901

Katalog CVE

CVSS 6.5 · Medium EPSS 5,0%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada intel core i7-6500u firmware, intel core i7-6510u firmware +58 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.

Rincian

Terbit di NVD

12 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

5,0% peluang dieksploitasi; lebih tinggi dari 92,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 145 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2022/07/12/2
• http://www.openwall.com/lists/oss-security/2022/07/12/4
• http://www.openwall.com/lists/oss-security/2022/07/12/5
• http://www.openwall.com/lists/oss-security/2022/07/13/1
• https://comsec.ethz.ch/retbleed
• https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html
• https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4RW5FCIYFNCQ...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M27MB3QFNIJV4...
• https://security.gentoo.org/glsa/202402-07
• https://security.netapp.com/advisory/ntap-20221007-0007/
• https://www.debian.org/security/2022/dsa-5207
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00702.html
• https://www.secpod.com/blog/retbleed-intel-and-amd-processor-information-disclosure-vulnerability/