Processor vulnerability
CVE-2023-20569
A mistrained predictor sees a CALL where there is none and pushes a target onto the return predictor, which a later kernel return then follows speculatively.
- Name
- Speculative Return Stack Overflow
- Also known as
- SRSO, Inception
- Kind
- Transient execution
- CVE published
- 2023-08-08 CVE record
- Advisories
- AMD-SB-7005
- Linux reports it in
spec_rstack_overflow
AMD processors predict returns from a return address predictor,
filled as the processor sees calls. An attacker can train the branch
target buffer so that the processor predicts a call at a place in
the kernel where there is none; that phantom call still pushes an
entry, and the next return in the kernel goes speculatively where
the attacker chose. Linux lists AMD families 17h, 19h and 1Ah and
Hygon family 18h. For Zen and Zen 2 AMD needs no microcode, as those
flush branch type predictions already; Zen 3 and Zen 4 need a
microcode update.What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
Affected processors
8 of the 8 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Zen | Affected | Linux 7.3 lists AMD family 17h in cpu_vuln_blacklist with SRSO | Linux 7.3 |
| Zen+ | Affected | Linux 7.3 lists AMD family 17h in cpu_vuln_blacklist with SRSO | Linux 7.3 |
| Zen 2 | Affected | Linux 7.3 lists AMD family 17h in cpu_vuln_blacklist with SRSO | Linux 7.3 |
| Zen 3 | Affected | Linux 7.3 lists AMD family 19h in cpu_vuln_blacklist with SRSO | Linux 7.3 |
| Zen 4 | Affected | Linux 7.3 lists AMD family 19h in cpu_vuln_blacklist with SRSO | Linux 7.3 |
| Zen 5 | Affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_blacklist with SRSO | Linux 7.3 |
| Zen 6 | Affected | Linux 7.3 lists AMD family 1Ah in cpu_vuln_blacklist with SRSO | Linux 7.3 |
| Dhyana | Affected | Linux 7.3 lists Hygon family 18h in cpu_vuln_blacklist with SRSO | Linux 7.3 |
Mitigations
- Microcode: On Zen 3 and Zen 4, a microcode update, delivered in AGESA firmware or loaded by the operating system, which the kernel's mitigations need. Source.
- Kernel: Safe RET: Linux sends every kernel return through a thunk that forces a misprediction to a safe target; IBPB on kernel entry is the costlier alternative. The option spec_rstack_overflow chooses. Source.
How to check a machine
On Linux, /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow holds one of these lines:
Not affectedVulnerableVulnerable: No microcodeVulnerable: Safe RET, no microcodeVulnerable: Microcode, no safe RETMitigation: SMT disabledMitigation: Safe RETMitigation: IBPBMitigation: IBPB on VMEXIT onlyMitigation: Reduced Speculation