Intel processors (branch history injection): MULTI-TENANT ISOLATION: BHI / Spectre-BHB: even with eIBRS enabled

Impact

MULTI-TENANT ISOLATION: BHI / Spectre-BHB: even with eIBRS enabled, the branch history buffer is shared across privilege levels, so unprivileged code can steer kernel-side speculation and read kernel memory. This is the attack that showed hardware Spectre-v2 mitigations were not the end of the story, and it is directly a container-to-host and guest-to-host read primitive.

Who can reach it

Local unprivileged code - any container or VM on the node.

What to do

Mitigated by an Intel microcode update plus OS/hypervisor changes. Microcode for this class is normally shipped by your distribution as an early-loadable image, so you can deploy it with a package update and a reboot without waiting for an OEM BIOS release - that distinction is the difference between a week and a quarter. Verify after reboot by reading /sys/devices/system/cpu/vulnerabilities/ rather than assuming the package took effect. Linux additionally offers unprivileged-eBPF disabling and BHB-clearing sequences; check the spectre_v2 sysfs file after patching to see which mitigation actually engaged.

References