AMD processors - LFENCE/JMP mitigation for Spectre v2 (CVE-2017-5715): The LFENCE/JMP sequence AMD originally

CVSS 5.6CVE-2021-26401Firmware, BMC & network fabricLFENCE/JMP insufficiencycurated

Impact

The LFENCE/JMP sequence AMD originally recommended as the cheap Spectre-v2 mitigation (mitigation V2-2) turns out not to sufficiently block branch target injection on some AMD CPUs. Anyone who took AMD's early guidance and chose LFENCE/JMP over retpoline because it was faster has been running with a Spectre-v2 mitigation that does not actually hold - a cross-VM and cross-process speculative disclosure channel that people believe is already closed. The dangerous part is the false sense of coverage, not the novelty of the attack.

Who can reach it

Local, cross-privilege and cross-guest speculative execution. Reachable from any tenant workload on affected hardware.

What to do

Switch from LFENCE/JMP to retpoline or hardware IBRS/IBPB. On Linux, verify what is actually active by reading /sys/devices/system/cpu/vulnerabilities/spectre_v2 on your fleet - do not assume, check, because the string tells you exactly which mitigation the kernel selected. Changing it needs a kernel update and/or boot parameter change plus a reboot; on some platforms full IBRS also needs microcode from an SBIOS update. Retpoline and IBRS both cost performance relative to LFENCE/JMP, which is why the weaker option got chosen in the first place.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-26401 https://www.amd.com/en/resources/product-security.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.