VDB

UBUNTU-CVE-2022-2196

UBUNTU-CVE-2022-2196 PUBLISHED CVSS 4.599999904632568 MEDIUM

Record from OSV · Published January 9, 2023

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or applying the relevant stable backports (v5.4.233, v5.10.170, v5.15.96, v6.1.14).

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
linux-gkeUbuntu:22.04:LTS5.15.0-1030.35
linux-ibm-5.4Ubuntu:18.04:LTS5.4.0-1046.51~18.04.1
linux-gcpUbuntu:20.04:LTS5.4.0-1102.111
linux-gcp-5.4Ubuntu:18.04:LTS5.4.0-1102.111~18.04.2
linux-raspi-5.4Ubuntu:18.04:LTS5.4.0-1082.93~18.04.1
linux-lowlatencyUbuntu:22.04:LTS5.15.0-69.76
linux-azureUbuntu:22.04:LTS5.15.0-1035.42
linux-hwe-5.19Ubuntu:22.04:LTS5.19.0-38.39~22.04.1
linux-awsUbuntu:20.04:LTS5.4.0-1099.107
linux-aws-fipsUbuntu:Pro:FIPS-updates:20.04:LTS5.4.0-1099.107+fips1
linux-aws-5.4Ubuntu:18.04:LTS5.4.0-1099.107~18.04.1
linux-gkeop-5.15Ubuntu:20.04:LTS5.15.0-1017.22~20.04.1

46 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0
4.599999904632568
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Affected products

VendorProductVersions
Ubuntu:18.04:LTSlinux-gcp4.15.0-1032.34, 4.15.0-1024.25, 4.15.0-1023.24
Ubuntu:22.04:LTSlinux-gke5.15.0-1020.25, 5.15.0-1019.23, 5.15.0-1017.20
Ubuntu:20.04:LTSlinux-riscv-5.115.11.0-1020.21~20.04.1, 5.11.0-1031.35, 5.11.0-1030.34
Ubuntu:18.04:LTSlinux-ibm-5.45.4.0-1042.47~18.04.1, 5.4.0-1040.45~18.04.2, 5.4.0-1037.42~18.04.1
Ubuntu:18.04:LTSlinux-aws-5.00, 5.0.0-1021.24~18.04.1, 5.0.0-1022.25~18.04.1
Ubuntu:22.04:LTSlinux-riscv5.15.0-1005.5, 5.15.0-1028.32, 5.15.0-1027.31
Ubuntu:20.04:LTSlinux-gcp5.4.0-1062.66, 5.4.0-1101.110, 5.4.0-1100.109
Ubuntu:18.04:LTSlinux-gcp-5.45.4.0-1044.47~18.04.2, 5.4.0-1046.49~18.04.1, 5.4.0-1049.53~18.04.1
Ubuntu:18.04:LTSlinux-raspi-5.45.4.0-1044.48~18.04.1, 5.4.0-1043.47~18.04.1, 5.4.0-1042.46~18.04.3
Ubuntu:20.04:LTSlinux-oracle-5.85.8.0-1031.32~20.04.2, 5.8.0-1033.34~20.04.1, 5.8.0-1034.35~20.04.2
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-41.44, 5.15.0-40.43, 5.15.0-39.42
Ubuntu:22.04:LTSlinux-azure5.13.0-1006.7, 5.15.0-1034.41, 5.15.0-1033.40
Ubuntu:18.04:LTSlinux-aws-5.35.3.0-1034.36, 5.3.0-1033.35, 5.3.0-1032.34~18.04.2
Ubuntu:18.04:LTSlinux-azure-5.30, 5.3.0-1007.8~18.04.1, 5.3.0-1032.33~18.04.1
Ubuntu:22.04:LTSlinux-hwe-5.195.19.0-28.29~22.04.1, 0, 5.19.0-32.33~22.04.1
Ubuntu:22.04:LTSlinux-realtime5.15.0-1032.35, 0
Ubuntu:20.04:LTSlinux-aws5.4.0-1018.18, 0, 5.3.0-1003.3
Ubuntu:Pro:FIPS-updates:20.04:LTSlinux-aws-fips5.4.0-1081.88+fips1, 5.4.0-1080.87+fips1, 5.4.0-1078.84+fips1
Ubuntu:18.04:LTSlinux-aws-5.45.4.0-1018.18~18.04.1, 5.4.0-1020.20~18.04.2, 5.4.0-1022.22~18.04.1
Ubuntu:20.04:LTSlinux-gcp-5.135.13.0-1023.28~20.04.1, 0, 5.13.0-1008.9~20.04.3

…and 81 more

Timeline

  • Jan 9, 2023 CVE Published
  • Oct 28, 2026 CVE Updated
  • Oct 30, 2026 Distribution Patch (12 in total, the first dated here)
  • Oct 30, 2026 Security Advisory (12 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln UBUNTU-CVE-2022-2196
vulnetix vdb fixes UBUNTU-CVE-2022-2196

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/UBUNTU-CVE-2022-2196/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›