UBUNTU-CVE-2022-21125 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2022-21125

MEDIUM5.5

Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Published Jun 15, 2022

Modified 6 months ago

Fix available

Details

Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Affected Packages(201 packages)

intel-microcode

Ubuntu 16.04 LTS

Affected versions:

3.20150121.13.20151106.13.20170707.1~ubuntu16.04.03.20180108.0+really20170707ubuntu16.04.13.20180108.0~ubuntu16.04.23.20180312.0~ubuntu16.04.13.20180425.1~ubuntu0.16.04.13.20180425.1~ubuntu0.16.04.23.20180807a.0ubuntu0.16.04.13.20190514.0ubuntu0.16.04.1+11 more

intel-microcode

Ubuntu 18.04 LTS

Affected versions:

3.20170707.13.20171117.13.20180108.13.20180108.1+really20171117.13.20180312.0~ubuntu18.04.13.20180425.1~ubuntu0.18.04.13.20180425.1~ubuntu0.18.04.23.20180807a.0ubuntu0.18.04.13.20190514.0ubuntu0.18.04.23.20190514.0ubuntu0.18.04.3+10 more

Fixed in:

3.20220510.0ubuntu0.18.04.1

intel-microcode

Ubuntu 20.04 LTS

Affected versions:

3.20190918.1ubuntu13.20191115.1ubuntu13.20191115.1ubuntu23.20191115.1ubuntu33.20200609.0ubuntu0.20.04.03.20200609.0ubuntu0.20.04.13.20200609.0ubuntu0.20.04.23.20201110.0ubuntu0.20.04.13.20201110.0ubuntu0.20.04.23.20210216.0ubuntu0.20.04.1+1 more

Fixed in:

3.20220510.0ubuntu0.20.04.1

intel-microcode

Ubuntu Pro 14.04 LTS

Affected versions:

1.20130906.1ubuntu21.20130906.1ubuntu32.20140122.12.20140430.1ubuntu12.20140624-t-1ubuntu23.20180108.0+really20170707ubuntu14.04.13.20180108.0~ubuntu14.04.23.20180312.0~ubuntu14.04.13.20180425.1~ubuntu0.14.04.13.20180425.1~ubuntu0.14.04.2+12 more

intel-microcode

Ubuntu 22.04 LTS

Affected versions:

3.20210608.2ubuntu1

Fixed in:

3.20220510.0ubuntu0.22.04.1

intel-microcode

Ubuntu Pro 16.04 LTS

Affected versions:

Fixed in:

3.20220510.0ubuntu0.16.04.1+esm1

linux

Ubuntu Pro 16.04 LTS

Affected versions:

4.2.0-16.194.2.0-17.214.2.0-19.234.3.0-1.104.3.0-2.114.3.0-5.164.3.0-6.174.3.0-7.184.4.0-10.254.4.0-101.124+131 more

Fixed in:

4.4.0-229.263

linux

Ubuntu Pro 14.04 LTS

Affected versions:

3.11.0-12.193.12.0-1.33.12.0-2.53.12.0-2.73.12.0-3.83.12.0-3.93.12.0-4.103.12.0-4.123.12.0-5.133.12.0-7.15+170 more

linux

Ubuntu 22.04 LTS

Affected versions:

5.13.0-19.195.15.0-17.175.15.0-18.185.15.0-22.225.15.0-23.235.15.0-25.255.15.0-27.285.15.0-30.315.15.0-33.345.15.0-35.36+1 more

Fixed in:

5.15.0-39.42

linux

Ubuntu 24.04 LTS

Fixed in:

6.5.0-9.9

References

REPORThttps://ubuntu.com/security/CVE-2022-21125 ADVISORYhttps://ubuntu.com/security/notices/USN-5484-1 ADVISORYhttps://ubuntu.com/security/notices/USN-5485-1 ADVISORYhttps://ubuntu.com/security/notices/USN-5485-2 ADVISORYhttps://ubuntu.com/security/notices/USN-5505-1 ADVISORYhttps://ubuntu.com/security/notices/USN-5513-1 ADVISORYhttps://ubuntu.com/security/notices/USN-5529-1 ADVISORYhttps://ubuntu.com/security/notices/USN-5535-1 REPORThttps://www.cve.org/CVERecord?id=CVE-2022-21125 REPORThttps://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/processor-mmio-stale-data-vulnerabilities.html#SBDS REPORThttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00615.html REPORThttps://xenbits.xen.org/xsa/advisory-404.html

CVSS Analysis

CVSS v3.1

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Upstream

CVE-2022-21125

USN-5484-1 USN-5485-1 USN-5485-2 USN-5505-1 USN-5513-1 USN-5529-1 USN-5535-1

Ecosystems(30)

Ubuntu 16.04 LTS Ubuntu 18.04 LTS Ubuntu 20.04 LTS Ubuntu Pro 14.04 LTS Ubuntu 22.04 LTS

Timeline

PublishedJun 15, 2022

ModifiedJul 15, 2025

UBUNTU-CVE-2022-21125

Details

Affected Packages(201 packages)

References

CVSS Analysis

Upstream

Related

Ecosystems(30)

Timeline