Anon4 (No.delete@this.example.com) on July 14, 2022 5:05 pm wrote:
> anon2 (anon.delete@this.anon.com) on July 14, 2022 4:29 pm wrote:
> > No it wasn't, it was BTB poisoning to influence indirect branches.
> > Branch direction forwards or backwads is not relevant.
>
> I've had my head to much on CFI recently.... forward edge, obviously branch direction is not relevant.

There seems to be nothing about "forward edge" in spectre vulnerability. It is about indirect branches which use the BTB, return branches can be such indirect branches on these CPUs.

>
> > Some CPUs use BTB for return branches in some situations. This is not somehow new nor was unknown at the
> > time. It was explicitly called out in a public discussion about the fix several years ago, actually.
>
> And was thought not to be exploitable, some people thought it was exploitable

That's what I said. Nothing new from hardware standpoint, the only problem is incomplete mitigation for spectre v2. Or if you really want to quibble about semantics, the fact remains that the exact problem was known about and called out when the fix was being discussed. No new hardware vulnerability discovery, this is exploitation of known hole in known incomplete software fix for spectre v2.

> however they could not come up with a practical attack at the time.
>
> Given the mitigation cost no one was going to roll out an expensive speculative (sic) mitigation against
> an attack which was not thought to be practical at the time. That 'expensive' is in money, performance
> losses cost real money for the hyperscalers and major ones can make a service economically unviable.

Aside, many such security issues that are fixed have *actual* practical attacks demonstrated. Most of this security patching and mitigation has no objective measurement or even metrics that can inform the benefit of fixes.