x86-64.net

Processor vulnerability

CVE-2022-29900

On AMD Zen and Zen 2 and older families, mistrained predictions for return instructions let an attacker run chosen code speculatively in the kernel.

Name
Retbleed (AMD)
Also known as
Retbleed, Branch Type Confusion
Vulnerability
Retbleed
Kind
Transient execution
CVE published
2022-07-12 CVE record
Advisories
AMD-SB-1037
Linux reports it in
retbleed
AMD’s predictor can treat a return as another kind of branch and predict its target from the branch target buffer, which an attacker can fill. AMD’s bulletin lists Zen and Zen 2 products (Ryzen 2000 to 5000 mobile, Threadripper, EPYC 7001 and 7002) and older A-series APUs; Linux also lists families 15h and 16h and Hygon family 18h. Zen 3 and later are not listed.

Affected processors

10 of the 10 microarchitectures listed are affected in all or some of their models.

What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
MicroarchitectureStatusDetailSource
BulldozerAffectedLinux 7.3 lists AMD family 15h in cpu_vuln_blacklist with RETBLEEDLinux 7.3
PiledriverAffectedLinux 7.3 lists AMD family 15h in cpu_vuln_blacklist with RETBLEEDLinux 7.3
SteamrollerAffectedLinux 7.3 lists AMD family 15h in cpu_vuln_blacklist with RETBLEEDLinux 7.3
ExcavatorAffectedLinux 7.3 lists AMD family 15h in cpu_vuln_blacklist with RETBLEEDLinux 7.3
ZenAffectedLinux 7.3 lists AMD family 17h in cpu_vuln_blacklist with RETBLEEDLinux 7.3
Zen+AffectedLinux 7.3 lists AMD family 17h in cpu_vuln_blacklist with RETBLEEDLinux 7.3
Zen 2AffectedLinux 7.3 lists AMD family 17h in cpu_vuln_blacklist with RETBLEEDLinux 7.3
JaguarAffectedLinux 7.3 lists AMD family 16h in cpu_vuln_blacklist with RETBLEEDLinux 7.3
PumaAffectedLinux 7.3 lists AMD family 16h in cpu_vuln_blacklist with RETBLEEDLinux 7.3
DhyanaAffectedLinux 7.3 lists Hygon family 18h in cpu_vuln_blacklist with RETBLEEDLinux 7.3

Mitigations

  • Kernel: Linux replaces every return in the kernel with a jump to one return thunk and untrains the predictor on kernel entry, so that kernel returns go only where the thunk sends them ("untrained return thunk"); IBPB on entry is the alternative. Source.

How to check a machine

On Linux, /sys/devices/system/cpu/vulnerabilities/retbleed holds one of these lines:

  • Not affected
  • Vulnerable
  • Mitigation: untrained return thunk
  • Mitigation: IBPB
  • Mitigation: IBRS
  • Mitigation: Enhanced IBRS
  • Mitigation: Stuffing

Source.

Sources

  1. AMD-SB-1037: AMD CPU Branch Type Confusion
  2. Linux 7.3 kernel-parameters.txt: retbleed=