Processor vulnerability
CVE-2022-23824
On AMD processors from Excavator to Zen 3, IBPB may not keep return predictions made before it from being used after it.
- Name
- IBPB and Return Stack Buffer Interactions
- Vulnerability
- Incomplete Branch Prediction Barrier
- Kind
- Transient execution
- CVE published
- 2022-11-09 CVE record
- Advisories
- AMD-SB-1040
An operating system that relies on IBPB to flush the return address
predictor when it switches processes or guests is exposed to Spectre
v2 through returns, as predictions from before the barrier can still
steer returns after it. AMD lists Zen to Zen 3 processors and the
last Bulldozer-family APUs.What the sources say of each microarchitecture.
Affected processors
5 of the 5 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Excavator | Some models | 7th Gen A-Series APUs and Athlon X4 | amd.com |
| Zen | Some models | 1st Gen EPYC (7001); Ryzen 2000 and Athlon 3000 mobile | amd.com |
| Zen+ | Some models | Ryzen 2000 desktop; 2nd Gen Threadripper (2000) | amd.com |
| Zen 2 | Some models | 2nd Gen EPYC (7002); Ryzen 3000 desktop and 4000; 3rd Gen Threadripper (3000) | amd.com |
| Zen 3 | Some models | 3rd Gen EPYC (7003); Ryzen 5000, 6000 and 7030; Threadripper PRO 5000 | amd.com |
Mitigations
- Kernel: The fix is in operating systems and hypervisors: besides the IBPB, filling the return stack buffer as AMD's speculation guidance describes (mitigation V2-3). Instructions: CALL, RET. Source.
Related CVEs
- CVE-2023-38575 Incomplete Branch Prediction Barrier: Intel