Spectre variant 1

Every processor that predicts conditional branches runs ahead on its guess and throws the work away when the guess was wrong, but what the discarded instructions loaded stays in the cache. An attacker who can train the predictor makes a bounds check, or any other test, look as if it passed. There is no single fix in the processor: the software that handles untrusted input puts a barrier (LFENCE) after such checks, or masks the index so that it stays in bounds even when the check is skipped.

CVEs

CVE	Name	Vendors	Published
CVE-2017-5753	Bounds Check Bypass (Spectre variant 1, Variant 1)	Intel, AMD, Hygon, Zhaoxin	2018-01-04
CVE-2018-3693	Bounds Check Bypass Store (described below)	Intel, AMD	2018-07-10
CVE-2019-1125	Spectre v1 swapgs (SWAPGS)	Intel	2019-09-03

What the vendors say

• AMD: AMD mitigates variant 1 through operating system updates, and believes it is not affected by the SWAPGS variant (CVE-2019-1125) because its processors do not speculate on the new GS base after a SWAPGS. Source.

How to check a machine

On Linux, /sys/devices/system/cpu/vulnerabilities/spectre_v1 reports it; the kernel’s documentation lists the lines it can hold.

CVEs without a page of their own

The sources give these CVEs too few facts of their own (affected processors, a mitigation, a check) for a page; this is what they say.

CVE-2018-3693: Bounds Check Bypass Store

A sub-variant of variant 1 (also called variant 1.1) in which the speculative code past the check stores data instead of loading it. AMD mitigates it through operating system updates, as it does variant 1; no source gives an affected-processor list or a check of its own for it. Source. CVE record (2018-07-10).