Processor vulnerability
CVE-2022-26373
On some processors with enhanced IBRS, a return right after a VM exit can still use a return prediction made by the guest before the exit.
- Name
- Post-barrier Return Stack Buffer Predictions
- Also known as
- PBRSB
- Vulnerability
- Spectre variant 2
- Kind
- Transient execution
- CVE published
- 2022-08-18 CVE record
- Advisories
- INTEL-SA-00706
- Linux reports it in
spectre_v2
The return stack buffer predicts return addresses from the calls the
processor has seen. Enhanced IBRS is meant to keep a guest’s
predictions out of the host, but on affected processors the first
return after a VM exit, or after an IBPB barrier, can still be
predicted from an entry the guest left. Linux reports it on the
spectre_v2 line as PBRSB-eIBRS.What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
Affected processors
16 of the 44 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Comet Lake | Affected | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_A5H stepping 2 (Comet Lake H): Software 06_A5H stepping 3 (Comet Lake-S): Software 06_A5H stepping 5 (Comet Lake-S): Software 06_A6H stepping 0 (Comet Lake U62): Software 06_A6H stepping 1 (Comet Lake U62): Software | Intel’s list |
| Ice Lake (client) | Affected | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Software | Intel’s list |
| Tiger Lake | Affected | 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 1 (Tiger Lake U): Software 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Software 06_8DH stepping 1 (Tiger Lake H): Software 06_8DH stepping 1 (Tiger Lake H): Software | Intel’s list |
| Alder Lake | Affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): Software 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): Software 06_97H stepping 5 (Catlow (Golden Cove)): Software 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): Software 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): Software | Intel’s list |
| Rocket Lake | Affected | 06_A7H stepping 1 (Rocket Lake): Software | Intel’s list |
| Raptor Lake | Affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Software 06_B7H stepping 1 (Catlow (Raptor Cove)): Software 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Software 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Software | Intel’s list |
| Lunar Lake | Affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Software | Intel’s list |
| Panther Lake | Affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Software | Intel’s list |
| Cooper Lake | Affected | 06_55H stepping B (Cooper Lake): Software | Intel’s list |
| Ice Lake (server) | Affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): Software 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Software | Intel’s list |
| Emerald Rapids | Affected | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Software | Intel’s list |
| Sapphire Rapids | Affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Software 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Software | Intel’s list |
| Clearwater Forest | Affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Software | Intel’s list |
| Kaby Lake | Some models | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Not Affected | Intel’s list |
| Coffee Lake | Some models | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Not Affected 06_8EH stepping B (Whiskey Lake U): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Software 06_9EH stepping A (Coffee Lake H): Not Affected 06_9EH stepping C (Coffee Lake S): Software 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Software | Intel’s list |
| Arrow Lake | Some models | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Not Affected 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Software 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Software | Intel’s list |
| Haswell | Not affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): Not Affected 06_3FH stepping 4 (Haswell Server EX): Not Affected | Intel’s list |
| Broadwell | Not affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Not Affected 06_56H stepping 3 (Broadwell DE V2 - V3): Not Affected 06_56H stepping 4 (Broadwell DE Y0): Not Affected 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Not Affected | Intel’s list |
| Skylake | Not affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Not Affected | Intel’s list |
| Meteor Lake | Not affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Not Affected | Intel’s list |
| Skylake-SP | Not affected | 06_55H stepping 3 (Skylake Server): Not Affected 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Not Affected | Intel’s list |
| Granite Rapids | Not affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Not Affected 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Not Affected | Intel’s list |
| Sierra Forest | Not affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Not Affected | Intel’s list |
| Bonnell | Not affected | Linux 7.3 lists INTEL_ATOM_BONNELL, INTEL_ATOM_BONNELL_MID in cpu_vuln_whitelist with NO_SPECULATION | Linux 7.3 |
| Saltwell | Not affected | Linux 7.3 lists INTEL_ATOM_SALTWELL, INTEL_ATOM_SALTWELL_MID, INTEL_ATOM_SALTWELL_TABLET in cpu_vuln_whitelist with NO_SPECULATION | Linux 7.3 |
| Goldmont | Not affected | 06_5CH stepping A (Apollo Lake): Not Affected 06_5FH stepping All (Denverton (Goldmont)): Not Affected | Intel’s list |
| Goldmont Plus | Not affected | 06_7AH stepping 8 (Gemini Lake): Not Affected | Intel’s list |
| Tremont | Not affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Not Affected 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Not Affected 06_96H stepping All (Elkhart Lake (Tremont)): Not Affected 06_9CH stepping All (Jasper Lake (Tremont)): Not Affected | Intel’s list |
| Gracemont | Not affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Not Affected 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Not Affected | Intel’s list |
| Bulldozer | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Piledriver | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Steamroller | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Excavator | Not affected | Linux 7.3 lists AMD family 15h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Zen | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Zen+ | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Zen 2 | Not affected | Linux 7.3 lists AMD family 17h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Zen 3 | Not affected | Linux 7.3 lists AMD family 19h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Zen 4 | Not affected | Linux 7.3 lists AMD family 19h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Zen 5 | Not affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Zen 6 | Not affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Bobcat | Not affected | Linux 7.3 lists AMD family 14h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Jaguar | Not affected | Linux 7.3 lists AMD family 16h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Puma | Not affected | Linux 7.3 lists AMD family 16h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
| Dhyana | Not affected | Linux 7.3 lists Hygon family 18h in cpu_vuln_whitelist with NO_EIBRS_PBRSB | Linux 7.3 |
Mitigations
- Hypervisor: After a VM exit, Linux's KVM executes one CALL to a safe target before any return, so the first return is predicted from that entry instead of one the guest left. Source.
How to check a machine
On Linux, /sys/devices/system/cpu/vulnerabilities/spectre_v2 holds one of these lines:
PBRSB-eIBRS: SW sequencePBRSB-eIBRS: VulnerablePBRSB-eIBRS: Not affected
These are part of the spectre_v2 line. Source.
Related CVEs
- CVE-2017-5715 Branch Target Injection
- CVE-2021-26401 LFENCE/JMP mitigation
- CVE-2022-0001 Branch History Injection
- CVE-2022-0002 Intra-mode Branch Target Injection
- CVE-2024-2201 Native Branch History Injection