Vulnerability
Incomplete Branch Prediction Barrier
An IBPB that leaves return predictions from before it usable afterwards, so it does not fully separate the code before and after the barrier.
- Kind
- Transient execution
- CVEs
- 2
- Published
- 2022–2024
IBPB is the barrier an operating system or hypervisor issues when it
switches between processes or guests that must not steer each
other’s indirect branches. On some Intel and AMD processors it does
not stop return instructions from using predictions made before it,
so Spectre v2 style attacks through returns stay possible where
software relies on IBPB alone. Linux 7.3 marks AMD processors whose
IBPB does not clear the return predictor, as CPUID reports it, with
the bug ibpb_no_ret.
CVEs
| CVE | Name | Vendors | Published |
|---|---|---|---|
| CVE-2022-23824 | IBPB and Return Stack Buffer Interactions | AMD | 2022-11-09 |
| CVE-2023-38575 | Incomplete Branch Prediction Barrier: Intel | Intel | 2024-03-14 |