Intel processors (intra-mode branch target injection): The intra-mode sibling of BHI: branch predictor state is shared

CVSS 6.5CVE-2022-0002Firmware, BMC & network fabricIntra-mode BTIcurated

Impact

The intra-mode sibling of BHI: branch predictor state is shared within a privilege level, so one sandboxed context can steer another's speculation without crossing rings. The concern is sandbox escape inside a single process - JIT tenants sharing a runtime.

Who can reach it

Local code inside the same privilege level as the victim, e.g. a sandboxed JIT tenant.

What to do

Mitigated by an Intel microcode update plus OS/hypervisor changes. Microcode for this class is normally shipped by your distribution as an early-loadable image, so you can deploy it with a package update and a reboot without waiting for an OEM BIOS release - that distinction is the difference between a week and a quarter. Verify after reboot by reading /sys/devices/system/cpu/vulnerabilities/ rather than assuming the package took effect.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-0002 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00598.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.