Intel processors (branch history injection): BHI / Spectre-BHB: even with eIBRS enabled, the branch history buffer is

CVSS 6.5CVE-2022-0001Firmware, BMC & network fabricBHISpectre-BHBBranch History Injectioncurated

Impact

BHI / Spectre-BHB: even with eIBRS enabled, the branch history buffer is shared across privilege levels, so unprivileged code can steer kernel-side speculation and read kernel memory. This is the attack that showed hardware Spectre-v2 mitigations were not the end of the story, and it is directly a container-to-host and guest-to-host read primitive.

Who can reach it

Local unprivileged code - any container or VM on the node.

What to do

Mitigated by an Intel microcode update plus OS/hypervisor changes. Microcode for this class is normally shipped by your distribution as an early-loadable image, so you can deploy it with a package update and a reboot without waiting for an OEM BIOS release - that distinction is the difference between a week and a quarter. Verify after reboot by reading /sys/devices/system/cpu/vulnerabilities/ rather than assuming the package took effect. Linux additionally offers unprivileged-eBPF disabling and BHB-clearing sequences; check the spectre_v2 sysfs file after patching to see which mitigation actually engaged.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-0001 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00598.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.