Vulnerability
Spectre variant 2
An attacker trains the indirect branch predictor so that a victim's indirect jump or call runs chosen code speculatively, leaking data through the cache.
- Also known as
- Branch Target Injection, Variant 2
- Kind
- Transient execution
- CVEs
- 6
- Published
- 2018–2024
- Linux reports it in
spectre_v2
Indirect jumps and calls take their target from a register or memory, and the processor guesses it from earlier branches before it is known. Where the predictor does not tell apart the branches of different programs, or of user and kernel mode, code in one context can plant a target that a branch in another follows speculatively. Later variants poison the history of branches (Branch History Injection) rather than the targets themselves, or attack within one privilege level.
The mitigations combine microcode controls (IBRS, STIBP and the IBPB barrier, driven through MSRs), compiler changes (retpolines, which replace indirect branches with returns that cannot be steered) and, on newer processors, hardware that keeps predictions of different modes apart (enhanced or automatic IBRS).
CVEs
| CVE | Name | Vendors | Published |
|---|---|---|---|
| CVE-2017-5715 | Branch Target Injection (Spectre variant 2, Variant 2) | Intel, AMD, Hygon | 2018-01-04 |
| CVE-2021-26401 | LFENCE/JMP mitigation (described below) | AMD | 2022-03-11 |
| CVE-2022-0001 | Branch History Injection (BHI, Spectre-BHB) | Intel | 2022-03-11 |
| CVE-2022-0002 | Intra-mode Branch Target Injection (IMBTI) | Intel | 2022-03-11 |
| CVE-2022-26373 | Post-barrier Return Stack Buffer Predictions (PBRSB) | Intel | 2022-08-18 |
| CVE-2024-2201 | Native Branch History Injection (described below) | Intel | 2024-12-19 |
What the vendors say
- AMD: AMD released microcode for variant 2 back to its first Bulldozer-based products, and mitigates it together with operating system updates. Source.
How to check a machine
On Linux, /sys/devices/system/cpu/vulnerabilities/spectre_v2 reports it; the kernel’s documentation lists the lines it can hold.
CVEs without a page of their own
The sources give these CVEs too few facts of their own (affected processors, a mitigation, a check) for a page; this is what they say.
CVE-2021-26401: LFENCE/JMP mitigation
On some AMD processors the LFENCE/JMP sequence, one of AMD's mitigations for variant 2, leaves a window wide enough to exploit; AMD recommends retpolines or IBRS instead. AMD-SB-1036. Source. CVE record (2022-03-11).
CVE-2024-2201: Native Branch History Injection
Branch History Injection carried out with gadgets found in the kernel itself, without unprivileged eBPF; Linux mitigates it with the BHI settings of its spectre_v2 line, listed under CVE-2022-0001. Source. CVE record (2024-12-19).