Processor vulnerability
CVE-2023-38575
On some Intel processors return predictor targets are not isolated between contexts as IBPB should ensure; microcode fixes it.
- Name
- Incomplete Branch Prediction Barrier: Intel
- Vulnerability
- Incomplete Branch Prediction Barrier
- Kind
- Transient execution
- CVE published
- 2024-03-14 CVE record
- Advisories
- INTEL-SA-00982
Intel’s advisory describes return predictor targets that are not
isolated between contexts, and its affected-processor list calls the
issue an incomplete branch prediction barrier. The microcode can be
loaded by the operating system; on SGX systems Intel advises
updating it in the platform flash, and SGX needed a TCB recovery.What the sources say of each microarchitecture. Intel’s list gives each CPUID family, model and stepping it covers, with Intel’s mitigation for it (Software, MCU for a microcode update, or Hardware).
Affected processors
3 of the 27 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Alder Lake | Affected | 06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): MCU 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): MCU 06_97H stepping 5 (Catlow (Golden Cove)): MCU 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): MCU 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): MCU | Intel’s list |
| Raptor Lake | Affected | 06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): MCU 06_B7H stepping 1 (Catlow (Raptor Cove)): MCU 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): MCU 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): MCU | Intel’s list |
| Sapphire Rapids | Affected | 06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): MCU 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): MCU | Intel’s list |
| Emerald Rapids | Fixed in hardware | 06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Hardware | Intel’s list |
| Haswell | Not affected | 06_3FH stepping 2 (Haswell Server EP/EP4S): Not Affected 06_3FH stepping 4 (Haswell Server EX): Not Affected | Intel’s list |
| Broadwell | Not affected | 06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Not Affected 06_56H stepping 3 (Broadwell DE V2 - V3): Not Affected 06_56H stepping 4 (Broadwell DE Y0): Not Affected 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Not Affected | Intel’s list |
| Skylake | Not affected | 06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Not Affected | Intel’s list |
| Kaby Lake | Not affected | 06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Not Affected | Intel’s list |
| Coffee Lake | Not affected | 06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Not Affected 06_8EH stepping B (Whiskey Lake U): Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_9EH stepping A (Coffee Lake H): Not Affected 06_9EH stepping C (Coffee Lake S): Not Affected 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Not Affected | Intel’s list |
| Comet Lake | Not affected | 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Not Affected 06_A5H stepping 2 (Comet Lake H): Not Affected 06_A5H stepping 3 (Comet Lake-S): Not Affected 06_A5H stepping 5 (Comet Lake-S): Not Affected 06_A6H stepping 0 (Comet Lake U62): Not Affected 06_A6H stepping 1 (Comet Lake U62): Not Affected | Intel’s list |
| Ice Lake (client) | Not affected | 06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Not Affected | Intel’s list |
| Tiger Lake | Not affected | 06_8CH stepping 1 (Tiger Lake U): Not Affected 06_8CH stepping 1 (Tiger Lake U): Not Affected 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Not Affected 06_8DH stepping 1 (Tiger Lake H): Not Affected 06_8DH stepping 1 (Tiger Lake H): Not Affected | Intel’s list |
| Rocket Lake | Not affected | 06_A7H stepping 1 (Rocket Lake): Not Affected | Intel’s list |
| Meteor Lake | Not affected | 06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Not Affected | Intel’s list |
| Arrow Lake | Not affected | 06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Not Affected 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Not Affected 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Not Affected | Intel’s list |
| Lunar Lake | Not affected | 06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Not Affected | Intel’s list |
| Panther Lake | Not affected | 06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Not Affected | Intel’s list |
| Skylake-SP | Not affected | 06_55H stepping 3 (Skylake Server): Not Affected 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Not Affected | Intel’s list |
| Cooper Lake | Not affected | 06_55H stepping B (Cooper Lake): Not Affected | Intel’s list |
| Ice Lake (server) | Not affected | 06_6AH stepping 6 (Ice Lake Xeon-SP): Not Affected 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Not Affected | Intel’s list |
| Granite Rapids | Not affected | 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Not Affected 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Not Affected 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Not Affected | Intel’s list |
| Sierra Forest | Not affected | 06_AFH stepping 3 (Sierra Forest (Crestmont)): Not Affected | Intel’s list |
| Clearwater Forest | Not affected | 06_DDH stepping 1 (Clearwater Forest (Darkmont)): Not Affected | Intel’s list |
| Goldmont | Not affected | 06_5CH stepping A (Apollo Lake): Not Affected 06_5FH stepping All (Denverton (Goldmont)): Not Affected | Intel’s list |
| Goldmont Plus | Not affected | 06_7AH stepping 8 (Gemini Lake): Not Affected | Intel’s list |
| Tremont | Not affected | 06_86H stepping 5 (Snow Ridge BTS (Tremont)): Not Affected 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Not Affected 06_96H stepping All (Elkhart Lake (Tremont)): Not Affected 06_9CH stepping All (Jasper Lake (Tremont)): Not Affected | Intel’s list |
| Gracemont | Not affected | 06_9AH stepping 4 (Arizona Beach (Gracemont)): Not Affected 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Not Affected | Intel’s list |
Mitigations
- Microcode: Intel's microcode update of March 2024, from the operating system or, with SGX, in the firmware's flash. Source.
Related CVEs
- CVE-2022-23824 IBPB and Return Stack Buffer Interactions