In the Linux kernel, the following vulnerability has been resolved:
KVM: VMX: Prevent RSB underflow before vmenter
On VMX, there are some balanced returns between the time the guest's SPEC_CTRL value is written, and the vmenter.
Balanced returns (matched by a preceding call) are usually ok, but it's at least theoretically possible an NMI with a deep call stack could empty the RSB before one of the returns.
For maximum paranoia, don't allow any returns (balanced or otherwise) between the SPEC_CTRL write and the vmenter.
[ bp: Fix 32-bit build. ]
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"302234885813613958568173580095751778748",
"74424016116969006582518840537174002083",
"159720248237560392984628979207752914911",
"33219614472662598115347921722954161173"
]
},
"target": {
"file": "arch/x86/kvm/vmx/vmx_ops.h"
},
"signature_version": "v1",
"id": "CVE-2022-49610-11b3fab8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "181262052019410562322976267752778028130",
"length": 3132.0
},
"target": {
"file": "arch/x86/kvm/vmx/vmx.c",
"function": "vmx_vcpu_run"
},
"signature_version": "v1",
"id": "CVE-2022-49610-29363848",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"257943817065012065794554432787267576778",
"295905572913382848933459950817116094243",
"209153283571951035322814859634227639248",
"175701597456369944459294587759462069509",
"43334486843913041335164243483992945702",
"49722840482859372783819251133420214279",
"159691622929496484025664138754434332096",
"40954890949305034008653705907706334565"
]
},
"target": {
"file": "arch/x86/kvm/vmx/vmx.h"
},
"signature_version": "v1",
"id": "CVE-2022-49610-322eba5a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"305992800706980906925999528440498032973",
"56369000712932768590679272705581706178",
"8094670022696044542378022692699444206",
"312640334306933498797876438725970892891"
]
},
"target": {
"file": "arch/x86/kvm/vmx/capabilities.h"
},
"signature_version": "v1",
"id": "CVE-2022-49610-45621282",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"257943817065012065794554432787267576778",
"295905572913382848933459950817116094243",
"209153283571951035322814859634227639248",
"175701597456369944459294587759462069509",
"43334486843913041335164243483992945702",
"49722840482859372783819251133420214279",
"159691622929496484025664138754434332096",
"40954890949305034008653705907706334565"
]
},
"target": {
"file": "arch/x86/kvm/vmx/vmx.h"
},
"signature_version": "v1",
"id": "CVE-2022-49610-45f4ee17",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "84542645988460300420968069744533747538",
"length": 3005.0
},
"target": {
"file": "arch/x86/kernel/asm-offsets.c",
"function": "common"
},
"signature_version": "v1",
"id": "CVE-2022-49610-674356b2",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "181262052019410562322976267752778028130",
"length": 3132.0
},
"target": {
"file": "arch/x86/kvm/vmx/vmx.c",
"function": "vmx_vcpu_run"
},
"signature_version": "v1",
"id": "CVE-2022-49610-72fd1669",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"305992800706980906925999528440498032973",
"56369000712932768590679272705581706178",
"8094670022696044542378022692699444206",
"312640334306933498797876438725970892891"
]
},
"target": {
"file": "arch/x86/kvm/vmx/capabilities.h"
},
"signature_version": "v1",
"id": "CVE-2022-49610-8913730d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"98253255455782704251654248453072307596",
"225256394484397398429058292581410538771",
"14125282753860562710482655249640053208",
"219197269120243320046227251000953325515",
"265341890446666886456803840658104124113",
"179334629040812249807178418140123726458"
]
},
"target": {
"file": "arch/x86/kernel/asm-offsets.c"
},
"signature_version": "v1",
"id": "CVE-2022-49610-8f8c7226",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174324603829540330889503781805646369626",
"81755253594585538960487034923675866181",
"136919738902668993846494396108207095465",
"332827311643803863797403891557188738085",
"265341890446666886456803840658104124113",
"179334629040812249807178418140123726458"
]
},
"target": {
"file": "arch/x86/kernel/asm-offsets.c"
},
"signature_version": "v1",
"id": "CVE-2022-49610-97aeef31",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241070121709703608458725793092682885807",
"231525651683189789861792206511786238619",
"111985930820921255648446107651231814635",
"295736318084874431177623285228623821449"
]
},
"target": {
"file": "arch/x86/kvm/vmx/vmx.c"
},
"signature_version": "v1",
"id": "CVE-2022-49610-c89bdb06",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "7778331930611371832552327262317518831",
"length": 2283.0
},
"target": {
"file": "arch/x86/kernel/asm-offsets.c",
"function": "common"
},
"signature_version": "v1",
"id": "CVE-2022-49610-d3611290",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afd743f6dde87296c6f3414706964c491bb85862"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"302234885813613958568173580095751778748",
"74424016116969006582518840537174002083",
"159720248237560392984628979207752914911",
"33219614472662598115347921722954161173"
]
},
"target": {
"file": "arch/x86/kvm/vmx/vmx_ops.h"
},
"signature_version": "v1",
"id": "CVE-2022-49610-d8b8642d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"241070121709703608458725793092682885807",
"231525651683189789861792206511786238619",
"111985930820921255648446107651231814635",
"295736318084874431177623285228623821449"
]
},
"target": {
"file": "arch/x86/kvm/vmx/vmx.c"
},
"signature_version": "v1",
"id": "CVE-2022-49610-eaa666fd",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07853adc29a058c5fd143c14e5ac528448a72ed9"
}
]