On first glance it looks like many CPUs are vulnerable to same-privilege mis-speculation leaks (e.g. in JIT engines - disable eBPF jit if you have it enabled), but Intel has the real SNAFU in letting it leak across privilege modes.
-
Show this thread
-
Then there's the branch target misprediction attack; it seems to rely a lot on the details of Intel branch prediction, but it's unclear whether other CPUs are affected by variants of it. Maybe this is patchable in microcode?
3 replies 7 retweets 10 likesShow this thread -
Replying to @marcan42
Considering branch prediction & speculative loading is very likely on the hot path, I don’t think it’s implemented in microcode :/
1 reply 0 retweets 1 like -
Replying to @Taiki__San
But if the problem is branch predictor injection, they can just flush branch predictor state on kernel/userspace transitions. That likely wouldn't have a massive performance impact.
2 replies 0 retweets 0 likes -
Replying to @marcan42
I may be wrong but I don’t think there is any mechanism in place to do that. And even then by the time the context switch is actually executed, you may already have speculatively executed further instructions
1 reply 0 retweets 0 likes -
Replying to @Taiki__San
There is no *user-accessible* architecturally defined mechanism for that that I'm aware of, but it's entirely possible they have a way of doing it in microcode. "Flush/disable/whatever the BTB" sounds like the kind of chicken bit they'd have. Hence microcode fix.
3 replies 0 retweets 0 likes
I doubt flushing the branch prediction on syscalls will have nearly as much impact as flushing TLBs/changing pagetables as KPTI is doing. Branch state is a lot more transient and relevant to tight loops than page tables.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.