Processor vulnerability
CVE-2022-27672
When an SMT thread goes idle, its sibling can predict its next returns from the idle thread's entries, which a guest that may idle the core can plant.
- Name
- Cross-Thread Return Address Predictions
- Kind
- Transient execution
- CVE published
- 2023-02-14 CVE record
- Advisories
- AMD-SB-1045
With both threads running, each has its own 16-entry return address
predictor; when one goes idle (HLT or MWAIT), the other switches to
a 32-entry predictor over the same entries, and its pointer can land
on entries the idle thread left. A return right after the switch can
then go to a target the other thread planted. The kernel already
refills the predictor with safe targets when it switches to its idle
task; the gap is a virtual machine allowed to idle the processor
itself. Linux has no sysfs file for it.What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
Affected processors
4 of the 4 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Zen | Affected | Linux 7.3 lists AMD family 17h in cpu_vuln_blacklist with SMT_RSB | Linux 7.3 |
| Zen+ | Affected | Linux 7.3 lists AMD family 17h in cpu_vuln_blacklist with SMT_RSB | Linux 7.3 |
| Zen 2 | Affected | Linux 7.3 lists AMD family 17h in cpu_vuln_blacklist with SMT_RSB | Linux 7.3 |
| Dhyana | Affected | Linux 7.3 lists Hygon family 18h in cpu_vuln_blacklist with SMT_RSB | Linux 7.3 |
Mitigations
- Kernel: Before idling, Linux switches to its idle task, which fills the predictor with safe targets through a series of CALL instructions. Instructions: CALL. Source.
- Hypervisor: KVM keeps a guest from idling the processor itself by intercepting HLT and MWAIT, unless the host allows otherwise. Instructions: HLT, MWAIT. Source.