QID 354820

A regression exists in the linux kernel within kvm: nvmx that allowed for speculative execution attacks.
L2 can carry out spectre v2 attacks on l1 due to l1 thinking it doesn't need retpolines or ibpb after running l2 due to kvm (l0) advertising eibrs support to l1.
An attacker at l2 with code execution can execute code on an indirect branch on the host machine.
We recommend upgrading to kernel 6.2 or past commit 2e7eab81425a (cve-2022-2196) it has been discovered that on some amd cpus, the ras (return address stack, also called rap - return address predictor - in some amd documentation, and rsb - return stack buffer - in intel terminology) is dynamically partitioned between non-idle threads.
This allows an attacker to control speculative execution on the adjacent thread. (
( CVE-2022-27672) kernel: type confusion in pick_next_rt_entity(), which can result in memory corruption. (
( CVE-2023-1077) the upstream bug report describes this issue as follows: a flaw found in the linux kernel in rds (reliable datagram sockets) protocol.
The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion.
Local user can trigger this with rds_message_put().
Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user.
It is known how to trigger this, which causes an oob access, and a lock corruption. (
( CVE-2023-1078) in the linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. (
( CVE-2023-26545)

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.