What’s Vulnerable › Vulnerabilities

CVE-2022-29901: Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-12 · updated 2026-06-17
• Weakness: CWE-200

Description

Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.

Affected products

• Debian Linux: 10.0, 11.0 (and their updates)
• Fedoraproject Fedora: 35, 36 (and their updates)
• Intel Core I3-6100 Firmware: all versions
• Intel Core I3-6100E Firmware: all versions
• Intel Core I3-6100H Firmware: all versions
• Intel Core I3-6100T Firmware: all versions
• Intel Core I3-6100Te Firmware: all versions
• Intel Core I3-6100U Firmware: all versions
• Intel Core I3-6102E Firmware: all versions
• Intel Core I3-6110U Firmware: all versions
• Intel Core I3-6120 Firmware: all versions
• Intel Core I3-6120T Firmware: all versions
• Intel Core I3-6167U Firmware: all versions
• Intel Core I3-6300 Firmware: all versions
• Intel Core I3-6300T Firmware: all versions
• Intel Core I3-6320 Firmware: all versions
• Intel Core I3-6320T Firmware: all versions
• Intel Core I3-8000 Firmware: all versions
• Intel Core I3-8000T Firmware: all versions
• Intel Core I3-8020 Firmware: all versions
• Intel Core I3-8100 Firmware: all versions
• Intel Core I3-8100H Firmware: all versions
• Intel Core I3-8100T Firmware: all versions
• Intel Core I3-8109U Firmware: all versions
• Intel Core I3-8120 Firmware: all versions
• Intel Core I3-8130U Firmware: all versions
• Intel Core I3-8145U Firmware: all versions
• Intel Core I3-8300 Firmware: all versions
• Intel Core I3-8300T Firmware: all versions
• Intel Core I3-8350K Firmware: all versions

References

• http://www.openwall.com/lists/oss-security/2022/07/12/2
• http://www.openwall.com/lists/oss-security/2022/07/12/4
• http://www.openwall.com/lists/oss-security/2022/07/12/5
• http://www.openwall.com/lists/oss-security/2022/07/13/1
• https://comsec.ethz.ch/retbleed
• https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html
• https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4RW5FCIYFNCQOEFJEUIRW3DGYW7CWBG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M27MB3QFNIJV4EQQSXWARHP3OGX6CR6K/
• https://security.gentoo.org/glsa/202402-07
• https://security.netapp.com/advisory/ntap-20221007-0007/
• https://www.debian.org/security/2022/dsa-5207

Get alerted when CVE-2022-29901 or the next vulnerability affects your stack