CVE-2022-2196

What it actually does

Regression in KVM nVMX allows L2 guest to perform Spectre v2 indirect branch poisoning against L1 because KVM incorrectly advertises eIBRS support, bypassing retpolines and IBPB after L2 execution.

Why it matters to the business

In nested virtualization environments, attackers with L2 access can potentially escape to the host, risking data theft or code execution across tenant boundaries in cloud or server deployments.

How an attack unfolds

An attacker with code execution inside an L2 guest crafts Spectre v2 gadgets that exploit the missing IBPB/retpoline enforcement on L1 indirect branches, allowing speculative execution of host code.

How to fix it

Upgrade affected Linux kernels to version 6.2 or apply commit 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 in the KVM nVMX code path; disable nested virtualization where not required.

How to confirm the fix worked

Verify kernel version is 6.2 or later, confirm presence of commit 2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 via git log or source inspection, and test that eIBRS advertisement to L1 is corrected.

Typical attack path

1. Obtain code execution inside L2 guest VM
2. Identify or create Spectre v2 gadget targeting L1 indirect branches
3. Trigger branch poisoning to execute arbitrary host code via speculative execution

How to detect it

Review system logs for unexpected VM exits or indirect branch behavior; correlate with process execution inside guests; no public exploitation artifacts known, so focus on post-upgrade verification and host integrity monitoring.

What your security team should do

• Prioritize kernel upgrades on all systems using KVM nested virtualization
• Audit environments for nested VM usage and restrict where possible
• Monitor vendor advisories for backports to supported LTS kernels
• Apply compensating controls such as disabling eIBRS or forcing IBPB if upgrade is delayed