Spectre RETurns with new speculative execution vulnerabilities: Retbleed

[ElementDave]

It's that time of month. Spectre returns with new vulnerabilities and corresponding performance-crippling mitigations for affected x86 Intel and AMD CPUs.

Retbleed: Arbitrary Speculative Code Execution with Return Instructions

"Retbleed (CVE-2022-29900 and CVE-2022-29901) is the new addition to the family of speculative execution attacks that exploit branch target injection to leak information, which we call Spectre-BTI. Unlike its siblings, who trigger harmful branch target speculation by exploiting indirect jumps or calls, Retbleed exploits return instructions. This means a great deal, since it undermines some of our current Spectre-BTI defenses."

CPUs known to be vulnerable: "We have verified that Retbleed works on AMD Zen 1, Zen 1+, Zen 2 and Intel Core generation 6–8." The authors further clarify: "If it sports an AMD CPU family 0x15–0x17 or an Intel Core generation 6–8, it is likely affected. Note that we have only tested AMD CPU family 0x17 (AMD Zen 1, Zen 1+ and Zen 2)."

Performance impact: "Our performance evaluation shows that mitigating Retbleed has unfortunately turned out to be expensive: we have measured between 14% and 39% overhead with the AMD and Intel patches respectively.."

A Linux kernel patch adds a new kernel parameter "retbleed" to control the mitigations, including an option to disable them altogether.

According to an Intel blog, "... Windows systems are not affected given that these systems use Indirect Branch Restricted Speculation (IBRS) by default which is is also the mitigation being made available to Linux users. Intel is not aware of this issue being exploited outside of a controlled lab environment."

As one might imagine, various tech news sites have reported on the vulnerability. New working speculative execution attack sends Intel and AMD scrambling (Ars Technica)

 

[schoolslave]

Kudos to these researches for a tongue-in-cheek indictment of all the (mostly unnecessary) paranoia around these types of exploits:

 

[drescherjm]

Performance impact: "Our performance evaluation shows that mitigating Retbleed has unfortunately turned out to be expensive: we have measured between 14% and 39% overhead with the AMD and Intel patches respectively.."

It's a bit frustrating that the mitigations are so expensive in terms of performance loss.

 

[atarione]

What is super is that the 1st link suggests windows systems are vulnerable while the 2nd one suggests they are not.... /slow clap.... Sooo yeah anyone know if windows is or is not vulnerable to this particular exploit?

Are only Linux systems affected?

We’ve built the proof of concept code for Linux. But, because the fundamental issue is at the hardware level, Microsoft and Apple computers with the affected hardware have this issue too.

Intel has worked with the Linux community and VMM vendors to provide customers with software mitigation guidance which should be available on or around today's public disclosure date. Note that Windows systems are not affected given that these systems use Indirect Branch Restricted Speculation (IBRS) by default which is is also the mitigation being made available to Linux users. Intel is not aware of this issue being exploited outside of a controlled lab environment.

 

[Nobu]

What is super is that the 1st link suggests windows systems are vulnerable while the 2nd one suggests they are not.... /slow clap.... Sooo yeah anyone know if windows is or is not vulnerable to this particular exploit?

The hardware is suceptable too (should go without saying, since Linux runs on the same hardware as Windows and Apple), but the OS (windows) uses IBRS by default so it is not vulnerable (by default).

 

[DukenukemX]

I don't care because I've yet to see any real world virus or malware use this. So I just disable the mitigation with "mitigations=off" in grub on Linux and move on with my life. I'm not about to lose CPU performance I paid for. I'm not against AMD or Intel sending me new CPU's that aren't vulnerable, for free of course.

just edit this

/etc/default/grub

change this.

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash mitigations=off retbleed=off"

and then run this.

sudo update-grub

Then move on with your life.

 

[pillagenburn]

is mitigation for this even necessary for a private esxi server?