Today's Spectre variant: branch history injection [LWN.net]

A few days prior to the expected 5.17 release, the mainline kernel has just received a series of Spectre mitigations for the x86 and ARM architectures. The vulnerability this time is called "branch history injection"; it has been deemed CVE-2022-0001 and CVE-2022-0002. Some information can be found in this Intel disclosure, this ARM advisory, and this VUSec page:

Branch History Injection (BHI or Spectre-BHB) is a new flavor of Spectre-v2 in that it can circumvent eIBRS and CSV2 to simplify cross-privilege mistraining. The hardware mitigations do prevent the unprivileged attacker from injecting predictor entries for the kernel. However, the predictor relies on a global history to select the target entries to speculatively execute. And the attacker can poison this history from userland to force the kernel to mispredict to more “interesting” kernel targets (i.e., gadgets) that leak data.

According to a documentation patch merged into the mainline, the only known way to exploit this problem is via unprivileged BPF.

to post comments

Today's Spectre variant: branch history injection

Posted Mar 9, 2022 16:45 UTC (Wed) by willy (subscriber, #9762) [Link] (1 responses)

That documentation patch contradicts the information on the VUSec page. They're pretty explicit too:

> So, is disabling unprivileged eBPF sufficient?

> As hinted in the answer above, we believe this is not the case. However, we believe unprivileged eBPF does tremendously facilitate speculative execution (and other) attacks. Hence, we recommend disabling it.

Today's Spectre variant: branch history injection

Posted Mar 14, 2022 22:50 UTC (Mon) by cypherpunks2 (guest, #152408) [Link]

I wonder how seccomp-bpf (which uses a reduced subset of full eBPF) impacts this attack. Would disabling unprivileged eBPF still make the attack harder even if seccomp-bpf is always unprivileged?