CVE-2017-5715

The branch target buffer that predicts indirect branches is indexed by only part of a branch’s address, so a branch in the attacker’s code can share an entry with a branch in the victim’s. The attacker jumps to a chosen target from such an alias, then enters the victim, whose indirect branch speculatively runs that target: a gadget that loads secret data and leaves a trace of it in the cache. On processors with simultaneous multithreading, the sibling thread can train the shared predictor too.

Linux reports variant 2 on every processor that speculates, except where it lists the processor as not affected: the Zhaoxin and Centaur family 7 parts, and the Bonnell and Saltwell Atoms.

Affected processors

59 of the 63 microarchitectures listed are affected in all or some of their models.

Mitigations

• Compiler: Retpolines: the compiler turns each indirect call or jump in the kernel into a return through a thunk whose speculative path loops in place, so no poisoned prediction is followed. Source.
• Microcode: IBRS, STIBP and IBPB: microcode adds IA32_SPEC_CTRL (MSR 48H), whose bits restrict indirect branch speculation (IBRS) and stop sharing predictions between the threads of a core (STIBP), and IA32_PRED_CMD (MSR 49H), a write of whose bit 0 is a barrier (IBPB) that discards earlier predictions. Linux uses IBPB between processes of different users. Instructions: WRMSR. Source.
• Hardware: Enhanced IBRS (Intel) and Automatic IBRS (AMD): set once at boot, they keep predictions made in a less privileged mode out of more privileged ones; Linux then turns retpolines off. Source.

How to check a machine

On Linux, /sys/devices/system/cpu/vulnerabilities/spectre_v2 holds one of these lines:

• Not affected
• Vulnerable
• Mitigation: Retpolines
• Mitigation: Enhanced / Automatic IBRS
• Mitigation: Enhanced / Automatic IBRS + LFENCE
• Mitigation: Enhanced / Automatic IBRS + Retpolines
• Mitigation: IBRS
• Vulnerable: LFENCE

A mitigation is followed by the state of IBPB, STIBP, RSB filling, PBRSB-eIBRS and BHI, each after a semicolon. Source.

Related CVEs

• CVE-2021-26401 LFENCE/JMP mitigation
• CVE-2022-0001 Branch History Injection
• CVE-2022-0002 Intra-mode Branch Target Injection
• CVE-2022-26373 Post-barrier Return Stack Buffer Predictions
• CVE-2024-2201 Native Branch History Injection