PT-2022-4409 · Intel+3 · Intel Processors+3

Johannes Wikner + 1 · Published 2022-06-27 · Updated 2025-02-14 · CVE-2022-28693

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Intel(R) Processors (affected versions not specified)

Description The issue is related to an unprotected alternative channel of return branch target prediction in some Intel(R) Processors, which may allow an authorized user to potentially enable information disclosure via local access. The RSBA behavior allows alternate branch predictors to be used by near RET instructions when the RSB is empty. When eIBRS is enabled, the predicted target of these alternate predictors are restricted to those belonging to the indirect branch predictor entries of the current prediction domain.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Information Disclosure

Weakness Enumeration

CWE-1037

CWE-420

CWE-119

CWE-200

Related Identifiers

BDU:2022-05273

CESA-2022_7110

CESA-2022_7134

CVE-2022-28693

OPENSUSE-SU-2022_3288-1

OPENSUSE-SU-2022_3293-1

OPENSUSE-SU-2022_4503-1

OPENSUSE-SU-2022_4574-1

OPENSUSE-SU-2022_4613-1

OPENSUSE-SU-2022_4616-1

OPENSUSE-SU-2022_4617-1

RHSA-2022:7110

RHSA-2022:7134

RHSA-2022:7337

RHSA-2022:7338

RHSA-2022:7933

RHSA-2022:8267

RHSA-2022:8973

RHSA-2022:8974

RHSA-2022_7110

RHSA-2022_7134

RHSA-2022_7337

RHSA-2022_7338

RHSA-2022_7933

RHSA-2022_8267

SUSE-SU-2022:3288-1

SUSE-SU-2022:3293-1

SUSE-SU-2022:4503-1

SUSE-SU-2022:4505-1

SUSE-SU-2022:4566-1

SUSE-SU-2022:4573-1

SUSE-SU-2022:4574-1

SUSE-SU-2022:4589-1

SUSE-SU-2022:4613-1

SUSE-SU-2022:4614-1

SUSE-SU-2022:4615-1

SUSE-SU-2022:4616-1

SUSE-SU-2022:4617-1

SUSE-SU-2022_4505-1

SUSE-SU-2022_4566-1

Affected Products

Centos

Intel Processors

Red Hat

Suse

References · 538

• https://osv.dev/vulnerability/SUSE-SU-2022:3288-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05273 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:4574-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-28693 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3293-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4573-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4589-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28693 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-28693 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-28693 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4613-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4614-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4505-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4615-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4616-1 · Vendor Advisory