Branch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by...
summary
Finds asynchronous branch predictor updates that create Branch Predictor Race Conditions allowing predictions to be inserted with the wrong privilege tag on all recent Intel CPUs. Introduces Branch Privilege Injection, a Spectre v2 primitive that trains in user mode and injects kernel‑tagged branch predictions, builds an end‑to‑end exploit that leaks arbitrary kernel memory from up‑to‑date Linux across six Intel generations, measures timing by varying NOP delays and an assembly‑line model of updates, achieves 5.6KiB/s on Raptor Cove, and reports microcode fixes plus proposed software mitigations.
AI-written summary · about
chapters (7)
- 0:00Branch Privilege Injection intro
- 1:17Branch predictors and Spectre v2
- 4:50Prediction update delays
- 7:21Race conditions vs EIBRS
- 10:06Exploiting race condition
- 11:51Vulnerability scope on Intel
- 12:32Conclusion and mitigations
related talks
01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”
24mThe Memory of a Meltdown
01h 03mBPF and Spectre: Mitigating transient execution attacks
49mBypassing KPTI Using the Speculative Behavior of the SWAPGS Instruction
36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps
31mInferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...