Bug 2061712 (CVE-2022-0001) - CVE-2022-0001 hw: cpu: intel: Branch History Injection (BHI)
Summary: CVE-2022-0001 hw: cpu: intel: Branch History Injection (BHI)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-0001
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2062155 2062156 2062157 2062158 2062159 2062160 2062161 2062635
Blocks: 2012088
TreeView+ depends on / blocked
 
Reported: 2022-03-08 11:43 UTC by Petr Matousek
Modified: 2022-06-16 11:24 UTC (History)
33 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in hw. The Branch History Injection (BHI) describes a specific form of intra-mode BTI. This flaw allows an unprivileged attacker to manipulate the branch history before transitioning to supervisor or VMX root mode. This issue is an effort to cause an indirect branch predictor to select a specific predictor entry for an indirect branch, and a disclosure gadget at the predicted target will transiently execute. This execution is possible since the relevant branch history may contain branches taken in previous security contexts, and in particular, in other predictor modes.
Clone Of:
Environment:
Last Closed: 2022-05-11 17:16:13 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:2229 0 None None None 2022-05-12 11:27:20 UTC
Red Hat Product Errata RHBA-2022:4630 0 None None None 2022-05-18 11:47:05 UTC
Red Hat Product Errata RHBA-2022:4693 0 None None None 2022-05-19 05:11:32 UTC
Red Hat Product Errata RHBA-2022:4969 0 None None None 2022-06-08 18:40:41 UTC
Red Hat Product Errata RHBA-2022:5088 0 None None None 2022-06-16 11:24:02 UTC
Red Hat Product Errata RHSA-2022:1975 0 None None None 2022-05-10 14:41:20 UTC
Red Hat Product Errata RHSA-2022:1988 0 None None None 2022-05-10 14:47:25 UTC

Description Petr Matousek 2022-03-08 11:43:21 UTC 
Branch History Injection (BHI) describes a specific form of intra-mode BTI (bug CVE-2022-0001), where an unprivileged attacker may manipulate branch history before transitioning to supervisor or VMX root mode in an effort to cause an indirect branch predictor to select a specific predictor entry for an indirect branch, and a disclosure gadget at the predicted target will transiently execute. This may be possible since the relevant branch history may contain branches taken in previous security contexts, and in particular, in other predictor modes.
Comment 7 errata-xmlrpc 2022-05-10 14:41:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1975 https://access.redhat.com/errata/RHSA-2022:1975
Comment 8 errata-xmlrpc 2022-05-10 14:47:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1988 https://access.redhat.com/errata/RHSA-2022:1988
Comment 9 Product Security DevOps Team 2022-05-11 17:16:09 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0001
Note You need to log in before you can comment on or make changes to this bug.