More Intel CPU security flaws revealed with Branch Privilege Injection

We only just had the reveal of Training Solo from VUSec for Intel and Arm, and now we have another security flaw in Intel CPUs with Branch Privilege Injection.

This was detailed by COMSEC, the computer security group of the Department of Information Technology and Electrical Engineering (D-ITET) at ETH Zürich in their new research post.

Who is affected? They said "All intel processors since the 9th generation (Coffee Lake Refresh) are affected by Branch Privilege Injection. However, we have observed predictions bypassing the Indirect Branch Prediction Barrier (IBPB) on processors as far back as 7th generation (Kaby Lake)". And while their testing has been on Linux, it is a hardware issue so all systems will be affected by it.

Explaining it they said "Branch Privilege Injection (CVE-2024-45332) brings back the full might of branch target injection attacks (Spectre-BTI) on Intel. Intel’s hardware mitigations against these types of attacks have held their ground for almost 6 years. In our work, we demonstrate how these mitigations can be broken due to a race condition in Intel CPUs".

Their video example:

YouTube videos require cookies, you must accept their cookies to view. View cookie preferences.
Accept Cookies & Show   Direct Link

As for updates to fix the problem, unfortunately it seems that will come with another performance cut "Intel has developed a microcode update for affected processors and provided us with one to evaluate on Alder Lake. We were able to verify that the microcode update stops our primitives that we use in the paper to detect the vulnerabilities. Our performance evaluation shows up to 2.7% overhead for the microcode mitigation on Alder Lake. We have also evaluated several potential alternative mitigation strategies in software with overheads between 1.6% (Coffee Lake Refresh) and 8.3% (Rocket lake). Please refer to our paper for more details."

Intel has since put up a security advisory on it.

Another time to keep an eye on system and BIOS updates.

AMD / Arm are not affected by this one.