Processor vulnerability
CVE-2022-21180
Atypical reads of some integrated devices' MMIO ranges hang Skylake-family processors; a guest given direct MMIO access could hang its host.
- Name
- Undefined MMIO Hang
- Vulnerability
- Intel processor errata
- Kind
- Other
- CVE published
- 2022-06-15 CVE record
- Advisories
- INTEL-SA-00645
Software allowed to read the MMIO ranges of certain integrated
devices can hang the platform with unusual reads: MCHBAR of device
0, part of GTTMMADR of the integrated graphics and TMBAR of device 4
on bus 0. On a single-user machine that adds little, but a
hypervisor that gives a guest direct MMIO access to one of those
devices lets the guest hang the host. Intel lists client Skylake-
family processors and Xeon E3 of that family, and offers no
microcode for it.What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
Affected processors
5 of the 27 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Skylake | Affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): MCU+Software | Intel’s list |
| Kaby Lake | Affected | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Software | Intel’s list |
| Coffee Lake | Affected | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Software 06_8EH stepping B (Whiskey Lake U): Software 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping A (Coffee Lake H): Software 06_9EH stepping C (Coffee Lake S): Software 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Software | Intel’s list |
| Comet Lake | Affected | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_A5H stepping 2 (Comet Lake H): Software 06_A5H stepping 3 (Comet Lake-S): Software 06_A5H stepping 5 (Comet Lake-S): Software 06_A6H stepping 0 (Comet Lake U62): Software 06_A6H stepping 1 (Comet Lake U62): Software | Intel’s list |
| Rocket Lake | Affected | 06_A7H stepping 1 (Rocket Lake): Software | Intel’s list |
| Haswell | Not affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): Not Affected 06_3FH stepping 4 (Haswell Server EX): Not Affected | Intel’s list |
| Broadwell | Not affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Not Affected 06_56H stepping 3 (Broadwell DE V2 - V3): Not Affected 06_56H stepping 4 (Broadwell DE Y0): Not Affected 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Not Affected | Intel’s list |
| Ice Lake (client) | Not affected | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Not Affected | Intel’s list |
| Tiger Lake | Not affected | 06_8CH stepping 1 (Tiger Lake U): Not Affected 06_8CH stepping 1 (Tiger Lake U): Not Affected 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Not Affected 06_8DH stepping 1 (Tiger Lake H): Not Affected 06_8DH stepping 1 (Tiger Lake H): Not Affected | Intel’s list |
| Alder Lake | Not affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): Not Affected 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): Not Affected 06_97H stepping 5 (Catlow (Golden Cove)): Not Affected 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): Not Affected 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): Not Affected | Intel’s list |
| Raptor Lake | Not affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Not Affected 06_B7H stepping 1 (Catlow (Raptor Cove)): Not Affected 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Not Affected 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Not Affected | Intel’s list |
| Meteor Lake | Not affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Not Affected | Intel’s list |
| Arrow Lake | Not affected | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Not Affected 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Not Affected 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Not Affected | Intel’s list |
| Lunar Lake | Not affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Not Affected | Intel’s list |
| Panther Lake | Not affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Not Affected | Intel’s list |
| Skylake-SP | Not affected | 06_55H stepping 3 (Skylake Server): Not Affected 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Not Affected | Intel’s list |
| Cooper Lake | Not affected | 06_55H stepping B (Cooper Lake): Not Affected | Intel’s list |
| Ice Lake (server) | Not affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): Not Affected 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Not Affected | Intel’s list |
| Emerald Rapids | Not affected | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Not Affected | Intel’s list |
| Sapphire Rapids | Not affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Not Affected 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Not Affected | Intel’s list |
| Granite Rapids | Not affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Not Affected 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Not Affected | Intel’s list |
| Sierra Forest | Not affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Not Affected | Intel’s list |
| Clearwater Forest | Not affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Not Affected | Intel’s list |
| Goldmont | Not affected | 06_5CH stepping A (Apollo Lake): Not Affected 06_5FH stepping All (Denverton (Goldmont)): Not Affected | Intel’s list |
| Goldmont Plus | Not affected | 06_7AH stepping 8 (Gemini Lake): Not Affected | Intel’s list |
| Tremont | Not affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Not Affected 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Not Affected 06_96H stepping All (Elkhart Lake (Tremont)): Not Affected 06_9CH stepping All (Jasper Lake (Tremont)): Not Affected | Intel’s list |
| Gracemont | Not affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Not Affected 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Not Affected | Intel’s list |
Mitigations
- Hypervisor: Giving direct MMIO access to the affected integrated devices only to trusted guests, and none to untrusted software. Source.
Related CVEs
- CVE-2021-0127 Breakpoint control flow
- CVE-2022-33972 Microcode keying calculation
- CVE-2023-39368 Bus lock regulator
- CVE-2023-45733 Hardware logic race
- CVE-2023-46103 Instruction sequence: Core Ultra
- CVE-2024-21823 DSA and IAA error reporting
- CVE-2024-21853 Hardware logic state machines: Xeon
- CVE-2024-24968 Hardware logic state machines
- CVE-2024-25939 Mirrored memory regions
- CVE-2024-31068 Machine check error avoidance derivative
- CVE-2024-36242 Sub-page permission
- CVE-2024-37020 DSA instruction sequence
- CVE-2024-38660 Sub-page permission: E-cores
- CVE-2024-39355 Physical or environmental conditions: 13th and 14th generation Core
- CVE-2025-20012 Incorrect behavior order: Core Ultra
- CVE-2025-20054 Core management exception
- CVE-2025-20103 Core management resource pool
- CVE-2025-22840 Instruction sequence: Xeon 6
- CVE-2025-31648 Microcode flow value handling
- CVE-2025-35973 Ring 0 value handling
- CVE-2026-20760 Overlapping protected memory ranges