CyberSecBulletin
CVE-2022-2196NVD status: Modified

Linux Kernel: Initialization of a Resource with an Insecure Default

Published Updated By the CyberSecBulletin desk

CVE-2022-2196 is a high-severity initialization of a resource with an insecure default vulnerability in Linux Kernel from Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b, 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5, 1b0cafaae8884726c597caded50af185ffc13349 as the first without the flaw, so updating Linux Kernel to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.35% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux Kernel to f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b or 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 or 1b0cafaae8884726c597caded50af185ffc13349 or 6b539a7dbb49250f92515c2ba60aea239efc9e35, whichever matches your release line, or a later version.
  2. Read the advisory on git.kernel.org for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux Kernel64b8f33b2e1e687d465b5cb382e7bec495f1e026 up to, but not including, f93a1a5bdcdd122aae0a3eab7a52c15b71fb725b; e089a83fbc55b8057f332c00f125acaa02b08ef7 up to, but not including, 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5; 02a3868d18fe639363f1cea6e6d7914513198e43 up to, but not including, 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5; 5c911beff20aa8639e7a1f28988736c13e03ed54 up to, but not including, 1b0cafaae8884726c597caded50af185ffc13349; 5c911beff20aa8639e7a1f28988736c13e03ed54 up to, but not including, 6b539a7dbb49250f92515c2ba60aea239efc9e35; 5c911beff20aa8639e7a1f28988736c13e03ed54 up to, but not including, 63fada296062e91ad9f871970d4e7f19e21a6a15; 5c911beff20aa8639e7a1f28988736c13e03ed54 up to, but not including, 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5; 5.4.47 up to, but not including, 5.4.233; and 5 more rangesf93a1a5bdcdd122aae0a3eab7a52c15b71fb725b, 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5, 1b0cafaae8884726c597caded50af185ffc13349, 6b539a7dbb49250f92515c2ba60aea239efc9e35, 63fada296062e91ad9f871970d4e7f19e21a6a15, 5.4.233
DebianDebian Linux10.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.15.8MediumCNA (google.com)
CVSS 3.18.8HighNVD

Official description

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or applying the relevant stable backports (v5.4.233, v5.10.170, v5.15.96, v6.1.14).

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

More Initialization of a Resource with an Insecure Default vulnerabilities (CWE-1188)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Other vulnerabilities in Linux Kernel

All Linux Kernel vulnerabilities

Recent Initialization of a Resource with an Insecure Default vulnerabilities

Spotted an error? Tell us.