Processor vulnerability
CVE-2022-0001
The branch history that steers indirect prediction is shared by user and kernel mode even under enhanced IBRS, so user code can steer kernel branches.
- Name
- Branch History Injection
- Also known as
- BHI, Spectre-BHB
- Vulnerability
- Spectre variant 2
- Kind
- Transient execution
- CVE published
- 2022-03-11 CVE record
- Advisories
- INTEL-SA-00598
- Linux reports it in
spectre_v2
Indirect branch predictors pick their prediction using the history of the branches taken just before (the branch history buffer). Enhanced IBRS keeps the predicted targets of different modes apart, but not that history: a user program can take a chosen series of branches, enter the kernel, and make an indirect branch there select a target that the kernel’s own code had left in the predictor.
AMD, Hygon, Zhaoxin and Centaur processors are listed by Linux as not affected.
Affected processors
22 of the 48 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Comet Lake | Affected | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_A5H stepping 2 (Comet Lake H): Software 06_A5H stepping 3 (Comet Lake-S): Software 06_A5H stepping 5 (Comet Lake-S): Software 06_A6H stepping 0 (Comet Lake U62): Software 06_A6H stepping 1 (Comet Lake U62): Software | Intel’s list |
| Ice Lake (client) | Affected | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Software | Intel’s list |
| Tiger Lake | Affected | 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Software 06_8DH stepping 1 (Tiger Lake H): Software 06_8DH stepping 1 (Tiger Lake H): Software | Intel’s list |
| Alder Lake | Affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): MCU+Software 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): MCU+Software 06_97H stepping 5 (Catlow (Golden Cove)): MCU+Software 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): MCU+Software 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): MCU+Software | Intel’s list |
| Rocket Lake | Affected | 06_A7H stepping 1 (Rocket Lake): Software | Intel’s list |
| Raptor Lake | Affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Hardware+Software 06_B7H stepping 1 (Catlow (Raptor Cove)): Hardware+Software 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Hardware+Software 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Hardware+Software | Intel’s list |
| Meteor Lake | Affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Hardware+Software | Intel’s list |
| Arrow Lake | Affected | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Hardware+Software 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Hardware+Software 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Hardware+Software | Intel’s list |
| Lunar Lake | Affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Hardware+Software | Intel’s list |
| Panther Lake | Affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Hardware+Software | Intel’s list |
| Cooper Lake | Affected | 06_55H stepping B (Cooper Lake): Software | Intel’s list |
| Ice Lake (server) | Affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): Software 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Software | Intel’s list |
| Emerald Rapids | Affected | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Hardware+Software | Intel’s list |
| Sapphire Rapids | Affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Hardware+Software 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Hardware+Software | Intel’s list |
| Granite Rapids | Affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Hardware+Software 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Hardware+Software 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Hardware+Software 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Hardware+Software | Intel’s list |
| Sierra Forest | Affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Hardware+Software | Intel’s list |
| Clearwater Forest | Affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Hardware+Software | Intel’s list |
| Goldmont Plus | Affected | 06_7AH stepping 8 (Gemini Lake): Software | Intel’s list |
| Tremont | Affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Software 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Software 06_96H stepping All (Elkhart Lake (Tremont)): Software 06_9CH stepping All (Jasper Lake (Tremont)): Software | Intel’s list |
| Gracemont | Affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Hardware+Software 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Hardware+Software | Intel’s list |
| Kaby Lake | Some models | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Not Affected | Intel’s list |
| Coffee Lake | Some models | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Not Affected 06_8EH stepping B (Whiskey Lake U): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping A (Coffee Lake H): Not Affected 06_9EH stepping C (Coffee Lake S): Not Affected 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Software | Intel’s list |
| Haswell | Not affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): Not Affected 06_3FH stepping 4 (Haswell Server EX): Not Affected | Intel’s list |
| Broadwell | Not affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Not Affected 06_56H stepping 3 (Broadwell DE V2 - V3): Not Affected 06_56H stepping 4 (Broadwell DE Y0): Not Affected 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Not Affected | Intel’s list |
| Skylake | Not affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Not Affected | Intel’s list |
| Skylake-SP | Not affected | 06_55H stepping 3 (Skylake Server): Not Affected 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Not Affected | Intel’s list |
| Bonnell | Not affected | Linux 7.3 lists INTEL_ATOM_BONNELL, INTEL_ATOM_BONNELL_MID in cpu_vuln_whitelist with NO_SPECULATION | Linux 7.3 |
| Saltwell | Not affected | Linux 7.3 lists INTEL_ATOM_SALTWELL, INTEL_ATOM_SALTWELL_MID, INTEL_ATOM_SALTWELL_TABLET in cpu_vuln_whitelist with NO_SPECULATION | Linux 7.3 |
| Goldmont | Not affected | 06_5CH stepping A (Apollo Lake): Not Affected 06_5FH stepping All (Denverton (Goldmont)): Not Affected | Intel’s list |
| K8 (Hammer) | Not affected | Linux 7.3 lists AMD family Fh in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| K10 (Family 10h) | Not affected | Linux 7.3 lists AMD family 10h, AMD family 12h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Bulldozer | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Piledriver | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Steamroller | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Excavator | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Zen | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Zen+ | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Zen 2 | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Zen 3 | Not affected | Linux 7.3 lists AMD family 19h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Zen 4 | Not affected | Linux 7.3 lists AMD family 19h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Zen 5 | Not affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Zen 6 | Not affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Bobcat | Not affected | Linux 7.3 lists AMD family 14h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Jaguar | Not affected | Linux 7.3 lists AMD family 16h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Puma | Not affected | Linux 7.3 lists AMD family 16h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Dhyana | Not affected | Linux 7.3 lists Hygon family 18h in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| LuJiaZui | Not affected | Linux 7.3 lists Centaur family 7, Zhaoxin family 7 in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
| Century Avenue (Shijidadao) | Not affected | Linux 7.3 lists Centaur family 7, Zhaoxin family 7 in cpu_vuln_whitelist with NO_BHI | Linux 7.3 |
Mitigations
- Hardware: Processors that have it get BHI_DIS_S, bit 10 of IA32_SPEC_CTRL, which stops the history of a lower mode from steering predictions in the kernel; Linux sets it. Instructions: WRMSR. Source.
- Kernel: Elsewhere Linux overwrites the branch history with a loop of branches on kernel entry and, for KVM, on VM exit; retpolines also protect against it. The boot option spectre_bhi controls it. Source.
How to check a machine
On Linux, /sys/devices/system/cpu/vulnerabilities/spectre_v2 holds one of these lines:
BHI: Not affectedBHI: RetpolineBHI: BHI_DIS_SBHI: SW loop, KVM SW loopBHI: VulnerableBHI: Vulnerable, KVM: SW loop
These are part of the spectre_v2 line, after its other fields. Source.
Related CVEs
- CVE-2017-5715 Branch Target Injection
- CVE-2021-26401 LFENCE/JMP mitigation
- CVE-2022-0002 Intra-mode Branch Target Injection
- CVE-2022-26373 Post-barrier Return Stack Buffer Predictions
- CVE-2024-2201 Native Branch History Injection