Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 858116 (CVE-2022-23816, CVE-2022-23825, CVE-2022-29900, CVE-2022-29901, retbleed) - [Tracker] Retbleed: Arbitrary Speculative Code Execution with Return Instructions
Summary: [Tracker] Retbleed: Arbitrary Speculative Code Execution with Return Instruct...
Status: CONFIRMED
Alias: CVE-2022-23816, CVE-2022-23825, CVE-2022-29900, CVE-2022-29901, retbleed
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard:
Keywords:
Depends on: 857951 XSA-407 876259
Blocks:
  Show dependency tree
 
Reported: 2022-07-15 03:34 UTC by John Helmert III
Modified: 2022-10-09 06:56 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-07-15 03:34:21 UTC
From bug 857951:

"Relevant oss-security thread: https://www.openwall.com/lists/oss-security/2022/07/12/5

The AMD vulnerabilities are AMD-issued CVE-2022-23816 and CVE-2022-23825, and the "Switzerland Government Common Vulnerability Program"-issued CVE-2022-29900.

CVE-2022-23816 (still unpublished) and CVE-2022-23825 together seem to refer to the same vulnerability tracked by CVE-2022-29900.

Seems like the kernel fix is not in a release yet.

Intel is using the Swiss CVE assignment of CVE-2022-29901."
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-07-15 03:37:13 UTC
From https://www.openwall.com/lists/oss-security/2022/07/12/2 (XSA-407):

"Researchers at ETH Zurich have discovered Retbleed, allowing for
arbitrary speculative execution in a victim context.

For more details, see:
  https://comsec.ethz.ch/retbleed

ETH Zurich have allocated CVE-2022-29900 for AMD and CVE-2022-29901 for
Intel.

Despite the similar preconditions, these are very different
microarchitectural behaviours between vendors.

On AMD CPUs, Retbleed is one specific instance of a more general
microarchitectural behaviour called Branch Type Confusion.  AMD have
assigned CVE-2022-23816 (Retbleed) and CVE-2022-23825 (Branch Type
Confusion).

For more details, see:
  https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1037

On Intel CPUs, Retbleed is not a new vulnerability; it is only
applicable to software which did not follow Intel's original Spectre-v2
guidance.  Intel are using the ETH Zurich allocated CVE-2022-29901.

For more details, see:
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00702.html
  https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/return-stack-buffer-underflow.html

ARM have indicated existing guidance on Spectre-v2 is sufficient."