Intel processors (indirect branch predictor race): Branch Privilege Injection: a race in how the indirect branch

CVSS 5.6CVE-2024-45332Firmware, BMC & network fabricBranch Privilege InjectionBPIBranch Predictor Race Conditionscurated

Impact

Branch Privilege Injection: a race in how the indirect branch predictor associates predictions with privilege level lets unprivileged code get its predictions applied in kernel context, reading kernel memory even on parts with hardware Spectre-v2 mitigations. The researchers demonstrated reading /etc/shadow on a fully patched machine - it defeats the mitigations operators had been told were sufficient.

Who can reach it

Local unprivileged code on the node - any container or VM.

What to do

Mitigated by an Intel microcode update plus OS/hypervisor changes. Microcode for this class is normally shipped by your distribution as an early-loadable image, so you can deploy it with a package update and a reboot without waiting for an OEM BIOS release - that distinction is the difference between a week and a quarter. Verify after reboot by reading /sys/devices/system/cpu/vulnerabilities/ rather than assuming the package took effect. Confirm the specific microcode revision Intel names for your stepping; this one is not fully closed by kernel changes alone.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-45332 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01247.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.