VUSec reveal 'Training Solo', more security issues for Intel and Arm CPUs

Researchers at VUSec have revealed what they're calling "Training Solo", a set of security issues across Intel and Arm CPUs that sound pretty annoying and serious.

It's all thoroughly complicated stuff, so they've included a TL;DR (too long; didn't read) in the project post:

We present Training Solo, the first systematic analysis of self-training Spectre-v2 attacks that break the core assumption behind domain isolation—even when implemented perfectly. Our work shows that attackers can speculatively hijack control flow within the same domain (e.g., kernel) and leak secrets across privilege boundaries, re-enabling classic Spectre-v2 scenarios without relying on powerful sandboxed environments like eBPF. We created a new test-suite to analyze the branch predictor in a self-training scenario.

We present three new classes of self-training Spectre-v2 attacks, backed by two end-to-end exploits on recent Intel CPUs that leak kernel memory at up to 17 KB/sec. Along the way, we uncovered two new hardware issues (CVE-2024-28956 and CVE-2025-24495) that completely break the domain isolation and re-enable traditional user-user, guest-guest, and even guest-host Spectre-v2 attacks.

Going over the blog post they list the three different issues and what generations of CPUs they affect:

• History-based attacks: "Affected: All Intel CPUs with eIBRS, including Intel’s latest generation Lion Cove which features the BHI_NO feature. Selected ARM CPUs, see vendor website".
• Indirect Target Selection (ITS) (CVE-2024-28956): "Affected: Intel Core 9th-11th, Intel Xeon 2nd-3rd".
• Lion Cove BPU issue (CVE-2025-24495): "Affected: Intel CPUs with Lion Cove core (Lunar Lake / Arrow Lake)".

Best make sure you check for some updates soon. You'll need a mixture of Linux kernel updates and firmware for this.

See all the details in their website post.