Intel processors (intra-mode branch target injection): The intra-mode sibling of BHI: branch predictor state is shared

Impact

The intra-mode sibling of BHI: branch predictor state is shared within a privilege level, so one sandboxed context can steer another's speculation without crossing rings. The concern is sandbox escape inside a single process - JIT tenants sharing a runtime.

Who can reach it

Local code inside the same privilege level as the victim, e.g. a sandboxed JIT tenant.

What to do

Mitigated by an Intel microcode update plus OS/hypervisor changes. Microcode for this class is normally shipped by your distribution as an early-loadable image, so you can deploy it with a package update and a reboot without waiting for an OEM BIOS release - that distinction is the difference between a week and a quarter. Verify after reboot by reading /sys/devices/system/cpu/vulnerabilities/ rather than assuming the package took effect.

References