Anon4 (no.delete@this.example.com) on July 14, 2022 2:17 pm wrote:
> anon2 (anon.delete@this.anon.com) on July 13, 2022 10:03 pm wrote:
> > anonymous2 (anonymous2.delete@this.example.com) on July 13, 2022 3:14 pm wrote:
> > > https://en.wikipedia.org/wiki/Retbleed
> >
> > Does not seem to be anything new in hardware just spectre variant 2 software fix in Linux was not complete.
>
> Variant 2 was against forward jump instructions,

No it wasn't, it was BTB poisoning to influence indirect branches. Branch direction forwards or backwads is not relevant.

https://spectreattack.com/spectre.pdf

Some CPUs use BTB for return branches in some situations. This is not somehow new nor was unknown at the time. It was explicitly called out in a public discussion about the fix several years ago, actually.

> the mitigation was to turn forward jumps in to returns
> which are architecturally similar but have a very different effect on the microarchitecture.
>
> This was 'retpoline' retbleed attacks the retpoline itself in a similar way to
> the way variant 2 attacked jumps. It makes use of the fact that returns start behaving
> like jumps when certain internal state is overflowed. So this is novel.
>
> Anything which uses retpolines is vulerable and that includes
> Windows and possibly macOS it's not just a Linux issue.
>
> IBRS and eIRBS basically completely migitate the problem these are available from Coffee
> Lake R and beyond (Intel called it 9th gen). You will note commerical OSes have been dropping
> support for older but still relatively recent x86 processors, now you know why.
>