cyber.hendryadrian.com
Threat Research · securityweek.com

Researchers Detail Spectre v2 Variant That Can Leak Data on Intel, AMD and Arm CPUs

· Original article ↗

Summary

Researchers describe Branch Target Reuse, a Spectre v2 variant that can exploit stale branch predictions to leak memory. They demonstrated Linux kernel exploits and reported mitigations are being implemented in software.

Key points

  • Branch Target Reuse (BTR) exploits stale indirect branch predictions after code is rewritten in memory, enabling speculative execution at obsolete offsets.
  • Researchers developed two Linux kernel exploits using cBPF; on modern Intel CPUs, one can leak arbitrary memory and bypass enabled mitigations, including a demonstrated root password hash leak.
  • The researchers found the underlying behavior on the Intel, AMD, and Arm CPUs they tested; AMD said the paper did not reveal a new vulnerability in its products and cited existing Spectre v2 guidance.
  • A malicious webpage attack appears feasible, but the researchers have not built a complete browser exploit; their Firefox proof of concept showed stale branch entries persisting in SpiderMonkey.
  • In GraalVM, researchers could reuse memory addresses but could not exploit stale entries before compilation and garbage collection erased them.
  • CPU vendors said software can mitigate BTR with mechanisms such as IBPB. Linux developers added an x86 mitigation for cBPF code reuse; Oracle has deployed some mitigations, while Mozilla is prioritizing site isolation.

Article Details

Attack Vectors
  • Branch Target Reuse (BTR) exploits stale indirect branch prediction entries after code is modified at runtime, enabling speculative execution into new code at obsolete offsets.
  • On Linux, the demonstrated exploits abuse cBPF to leak sensitive kernel memory; the researchers used one to locate and leak a root password hash.
  • A malicious website running JavaScript in a targeted user's Firefox browser may provide an attack route, although the researchers had not built a complete browser exploit.
  • In GraalVM, BTR could speculatively bypass memory masking in the strictest sandbox mode, but the researchers could not exploit it because compilation and garbage collection erased stale branch entries.
Defensive Notes
  • The article reports that CPU vendors identified the indirect branch prediction barrier (IBPB) as an existing mitigation mechanism.
  • Linux developers introduced an x86 mitigation that triggers an IBPB across every CPU core when cBPF is placed in a memory region previously used by BPF code.
  • Oracle rolled out some mitigations. Mozilla was prioritizing completion of site isolation over IBPB-based mitigations.
  • The researchers say hardware control-flow protections such as x86 IBT and Arm BTI make exploitation more difficult but do not fully remove the threat. They describe race-free IBT combined with constant blinding as a stronger defense.

Vendors

AMDin Italy have disclosed a new variant of the Spectre v2 attack that affects systems powered by Intel, AMD, and Arm CPUs.Armhave disclosed a new variant of the Spectre v2 attack that affects systems powered by Intel, AMD, and Arm CPUs.IntelSant’Anna in Italy have disclosed a new variant of the Spectre v2 attack that affects systems powered by Intel, AMD, and Arm CPUs.MozillaBecause Mozilla has yet to complete the rollout of site isolation, content from other tabs may share the attacker’s address space, exposing that data.OracleThe researchers analyzed Linux cBPF, Oracle’s GraalVM runtime, and SpiderMonkey, the JavaScript and WebAssembly engine in Firefox. They developed two end-to-end exploits against the Linux kernel. 

Products

DockerSeccomp, socket filtering, and packet filtering in applications like Docker and Chrome continue to rely on it.Google ChromeSeccomp, socket filtering, and packet filtering in applications like Docker and Chrome continue to rely on it.GraalVMThe researchers analyzed Linux cBPF, Oracle’s GraalVM runtime, and SpiderMonkey, the JavaScript and WebAssembly engine in Firefox. They developed two end-to-end exploits against the Linux kernel. LinuxThe researchers analyzed Linux cBPF, Oracle’s GraalVM runtime, and SpiderMonkey, the JavaScript and WebAssembly engine in Firefox. They developed two end-to-end exploits against the Linux kernel. Mozilla FirefoxThe researchers analyzed Linux cBPF, Oracle’s GraalVM runtime, and SpiderMonkey, the JavaScript and WebAssembly engine in Firefox. They developed two end-to-end exploits against the Linux kernel. SpiderMonkeyThe researchers analyzed Linux cBPF, Oracle’s GraalVM runtime, and SpiderMonkey, the JavaScript and WebAssembly engine in Firefox. They developed two end-to-end exploits against the Linux kernel. 

Related Articles