Arbitrary Speculative Code Execution Vulnerability in AMD Processors
CVE-2022-29900

6.5MEDIUM

Key Information:

Vendor

Amd
Status
Amd Processors
Vendor
CVE Published:
12 July 2022

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2022-29900?

This vulnerability arises due to mis-trained branch predictions for return instructions in certain AMD processors, potentially allowing attackers to execute arbitrary speculative code under specific microarchitecture-dependent conditions. This could lead to unauthorized information disclosure or manipulation of system behavior, emphasizing the need for users to apply security patches promptly to mitigate potential risks.

Affected Version(s)

AMD Processors Processor Some AMD Processors

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

retbleed-speculative-execution-poc
Created by abdul-kalam2000

References

https://www.amd.com/en/corporate/product-security/bulleti...
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory
https://www.debian.org/security/2022/dsa-5207
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.