CVE-2022-21125

hw: cpu: incomplete clean-up of microarchitectural fill buffers (aka SBDS)

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Una limpieza incompleta de los búferes de relleno de la microarquitectura en algunos procesadores Intel(R) puede permitir que un usuario autenticado permita potencialmente la divulgación de información por medio del acceso local

A flaw was found in hw. Incomplete cleanup of microarchitectural fill buffers on some Intel® Processors may allow an authenticated user to enable information disclosure via local access.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-11-12 CVE Reserved
2022-06-15 CVE Published
2023-09-20 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-459: Incomplete Cleanup

CAPEC

References (15)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html	Mailing List
https://security.netapp.com/advisory/ntap-20220624-0008	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
http://www.openwall.com/lists/oss-security/2022/06/16/1	2023-11-07
http://xenbits.xen.org/xsa/advisory-404.html	2023-11-07
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00615.html	2023-11-07

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHTEW3RXU2GW6S3RCPQG4VNCZGI3TOSV	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MCVOMHBQRH4KP7IN6U24CW7F2D2L5KBS	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4P2KJYL74KGLHE4JZETVW7PZH6ZIABA	2023-11-07
https://security.gentoo.org/glsa/202208-23	2023-11-07
https://www.debian.org/security/2022/dsa-5173	2023-11-07
https://www.debian.org/security/2022/dsa-5178	2023-11-07
https://www.debian.org/security/2022/dsa-5184	2023-11-07
https://access.redhat.com/security/cve/CVE-2022-21125	2022-12-13
https://bugzilla.redhat.com/show_bug.cgi?id=2090240	2022-12-13

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				*		x86		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				35 Search vendor "Fedoraproject" for product "Fedora" and version "35"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				36 Search vendor "Fedoraproject" for product "Fedora" and version "36"		-		Affected
Intel Search vendor "Intel"		Sgx Dcap Search vendor "Intel" for product "Sgx Dcap"				< 1.14.100.3 Search vendor "Intel" for product "Sgx Dcap" and version " < 1.14.100.3"		linux		Affected
Intel Search vendor "Intel"		Sgx Dcap Search vendor "Intel" for product "Sgx Dcap"				< 1.14.100.3 Search vendor "Intel" for product "Sgx Dcap" and version " < 1.14.100.3"		windows		Affected
Intel Search vendor "Intel"		Sgx Psw Search vendor "Intel" for product "Sgx Psw"				< 2.16.100.3 Search vendor "Intel" for product "Sgx Psw" and version " < 2.16.100.3"		windows		Affected
Intel Search vendor "Intel"		Sgx Psw Search vendor "Intel" for product "Sgx Psw"				< 2.17.100.3 Search vendor "Intel" for product "Sgx Psw" and version " < 2.17.100.3"		linux		Affected
Intel Search vendor "Intel"		Sgx Sdk Search vendor "Intel" for product "Sgx Sdk"				< 2.16.100.3 Search vendor "Intel" for product "Sgx Sdk" and version " < 2.16.100.3"		windows		Affected
Intel Search vendor "Intel"		Sgx Sdk Search vendor "Intel" for product "Sgx Sdk"				< 2.17.100.3 Search vendor "Intel" for product "Sgx Sdk" and version " < 2.17.100.3"		linux		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		-		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		beta		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_1		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_1a		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_1b		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_1c		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_1d		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_2		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_2a		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_2c		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_2d		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_3c		Affected
Vmware Search vendor "Vmware"		Esxi Search vendor "Vmware" for product "Esxi"				7.0 Search vendor "Vmware" for product "Esxi" and version "7.0"		update_3d		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0"		-		Affected