Intel processors (Indirect Branch Predictor structure): Indirector: reverse-engineering the Indirect Branch Predictor

UnscoredNCVD-2024-002-intel-processors-indirect-branchFirmware, BMC & network fabricIndirectorcurated

Impact

Indirector: reverse-engineering the Indirect Branch Predictor and Branch Target Buffer on recent Intel parts yielded high-precision branch target injection that works despite existing eIBRS/IBPB deployment, and showed that IBPB does not clear as much predictor state as assumed. The operator takeaway is that the barrier primitive hypervisors use for tenant separation is weaker than the documentation implies.

Who can reach it

Local code on an affected processor; the work targets cross-process and cross-privilege leakage.

What to do

No single CVE or microcode fix maps cleanly to this research. Mitigation is the existing toolkit applied more aggressively: keep microcode current, enable IBPB on context switch where your workload can absorb the cost, and treat co-tenancy of untrusted workloads on the same physical core as unsupported. Both cost throughput.

References

https://indirector.cpusec.org/

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.