"On AMD CPUs, Retbleed is one specific instance of a more general microarchitectural behaviour called Branch Type Confusion. AMD have assigned CVE-2022-23816 (Retbleed) and CVE-2022-23825 (Branch Type Confusion)." from: https://comsec.ethz.ch/research/microarch/retbleed/ mitigation patches: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce114c866860 Reproducible: Always
Rather confusing set of CVEs here. Relevant oss-security thread: https://www.openwall.com/lists/oss-security/2022/07/12/5 The AMD vulnerabilities are AMD-issued CVE-2022-23816 and CVE-2022-23825, and the "Switzerland Government Common Vulnerability Program"-issued CVE-2022-29900. CVE-2022-23816 (still unpublished) and CVE-2022-23825 together seem to refer to the same vulnerability tracked by CVE-2022-29900. Seems like the kernel fix is not in a release yet. Intel is using the Swiss CVE assignment of CVE-2022-29901.
From https://www.openwall.com/lists/oss-security/2022/07/12/2 (XSA-407): Researchers at ETH Zurich have discovered Retbleed, allowing for arbitrary speculative execution in a victim context. For more details, see: https://comsec.ethz.ch/retbleed ETH Zurich have allocated CVE-2022-29900 for AMD and CVE-2022-29901 for Intel. Despite the similar preconditions, these are very different microarchitectural behaviours between vendors. On AMD CPUs, Retbleed is one specific instance of a more general microarchitectural behaviour called Branch Type Confusion. AMD have assigned CVE-2022-23816 (Retbleed) and CVE-2022-23825 (Branch Type Confusion). For more details, see: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037 On Intel CPUs, Retbleed is not a new vulnerability; it is only applicable to software which did not follow Intel's original Spectre-v2 guidance. Intel are using the ETH Zurich allocated CVE-2022-29901. For more details, see: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00702.html https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/return-stack-buffer-underflow.html ARM have indicated existing guidance on Spectre-v2 is sufficient."
5.19 is out with fixes in mainline. Doesn't seem like anything's made it down to stable yet.
Seems like fixes are in: 5.10.135 5.15.59 5.18.16
