Beyond Exploit Scanning: A Functional Change-Driven Approach to Remote Software Version Identification

Branch Privilege Injection: Compromising Spectre v2 Hardware Mitigations by Exploiting Branch Predictor Race Conditions

Authors: Sandro Rüegge (ETH Zurich); Johannes Wikner (ETH Zurich); Kaveh Razavi (ETH Zurich)

Conference: USENIX Security

YouTube: N/A - Peer-reviewed paper

Overview

This groundbreaking paper from ETH Zurich introduces Branch Predictor Race Conditions (BPRC), a novel class of microarchitectural vulnerabilities that undermine hardware-enforced mitigations against Spectre v2 attacks on all recent Intel CPUs. The research, which earned a Distinguished Paper Award at USENIX Security, reveals that the asynchronous nature of branch predictor operations can lead to critical security boundaries being breached. Specifically, BPRC allows for the injection of privileged branch predictions from less privileged domains, effectively bypassing mechanisms like eIBRS (enhanced Indirect Branch Restricted Speculation) designed to prevent such cross-privilege attacks.

Leveraging BPRC, the researchers developed Branch Privilege Injection (BPI), a potent new Spectre v2 primitive. BPI enables an unprivileged attacker to inject arbitrary branch predictions tagged with kernel privilege from user mode, leading to a complete compromise of kernel memory. The study meticulously details three variants of BPRC, demonstrating how they breach user-to-kernel, guest-to-hypervisor, and Indirect Branch Prediction Barrier (IBPB) security boundaries. This work highlights a fundamental flaw in how modern Intel processors manage asynchronous prediction feedback, proving that even with state-of-the-art hardware mitigations enabled, a sophisticated class of transient execution attacks remains viable.

The implications of BPRC and BPI are profound, resurrecting the threat of cross-privilege BTI attacks that were widely considered mitigated by modern hardware. The authors not only provide a deep technical analysis of the vulnerability but also present an end-to-end exploit capable of leaking arbitrary kernel memory from up-to-date Linux systems across six generations of Intel CPUs. This research provides critical insights for both hardware architects and software developers, emphasizing the need for more robust synchronization in microarchitectural designs and the careful evaluation of existing and future mitigation strategies.

Background

To comprehend the intricacies of Branch Predictor Race Conditions (BPRC) and Branch Privilege Injection (BPI), it is essential to first understand the foundational concepts of branch prediction, Branch Target Injection (BTI) attacks, and the hardware and software mitigations designed to counter them.

Modern CPUs employ a Branch Prediction Unit (BPU) to anticipate the outcome of control-flow instructions, particularly indirect branches, which can jump to multiple possible target addresses determined at runtime. By accurately predicting these targets, the BPU allows the processor to fetch and execute instructions speculatively, significantly improving performance. On Intel architectures, these predictions are managed by two primary structures: the Branch Target Buffer (BTB), which provides IP-based (static) predictions, and the Indirect Branch Predictor (IBP), which provides path-based (dynamic) predictions using branch history recorded in the Branch History Buffer (BHB). AMD processors utilize similar structures like the BTB and Indirect Target Array (ITA). Additionally, return instructions often use a dedicated Return Stack Buffer (RSB), which, upon underflow, can fall back to general indirect branch prediction mechanisms, a behavior known as RSB Alternate (RSBA) on Intel.

Branch Target Injection (BTI), also known as Spectre v2, is a class of transient execution attacks where an attacker manipulates the BPU to misdirect speculative execution. The attacker trains a branch to predict a target address of their choosing, causing a victim branch in a privileged domain to speculatively execute a "disclosure gadget" that accesses sensitive data. This data is then exfiltrated via a side channel, such as Flush+Reload. A crucial aspect of BTI is aliasing, where an attacker's training branch maps to the same BTB set and tag as a victim branch.

In response to Spectre v2, hardware vendors introduced several mitigations. The primary hardware defense is Indirect Branch Restricted Speculation (IBRS), which aims to restrict branch predictions learned in less privileged domains (e.g., user mode, guest kernel) from being used in more privileged domains (e.g., supervisor mode, hypervisor). Early IBRS implementations required costly Model Specific Register (MSR) writes on every privilege transition. Newer Intel processors offer enhanced IBRS (eIBRS) and Automatic IBRS (AutoIBRS), while ARM offers CSV2, which are always-active after a single MSR write at boot-time, significantly reducing performance overhead. These enhanced mitigations rely on the BPU correctly associating predictions with the privilege domain of their origin.

Another hardware defense is the Indirect Branch Prediction Barrier (IBPB), a software-issued instruction that invalidates all indirect branch target predictions in the BTB and IBP. IBPB is typically used as a last resort in scenarios where contexts with the same privilege level distrust each other, due to its high performance penalty. Furthermore, vendors have introduced supplementary speculation controls to fine-tune microarchitectural behaviors. Examples include BHI_DIS_S (to mitigate Branch History Injection attacks by preventing privileged domains from using less privileged history for indirect branch predictions in supervisor mode), RRSBA_DIS_S (to disable RSBA speculation in supervisor mode), and IPRED_DIS_S (to disable indirect branch prediction in supervisor mode altogether).

Software defenses complement hardware mitigations. The lfence instruction can serialize the instruction stream, forcing operations to complete before subsequent instructions are dispatched. Techniques like Retpoline eliminate indirect branches by replacing them with sequences of direct jumps and returns, incurring a performance overhead due to forced mispredictions. Other software constructs include RSB stuffing and untrain procedures. Defense-in-depth strategies like Supervisor-Mode Execution Prevention (SMEP) and Supervisor-Mode Access Prevention (SMAP) further restrict supervisor interaction with user pages.

The challenge lies in the highly complex and asynchronous nature of branch prediction. As this paper demonstrates, the precise timing and ordering of branch prediction updates, privilege domain transitions, and mitigation barriers are critical, and current implementations on Intel CPUs have exploitable race conditions.

Key Findings

The research on Branch Predictor Race Conditions (BPRC) and Branch Privilege Injection (BPI) yielded several critical findings that fundamentally challenge the efficacy of current hardware mitigations against Spectre v2 attacks on Intel processors:

• Introduction of BPRC: The paper defines Branch Predictor Race Conditions (BPRC) as a new class of microarchitectural vulnerabilities. These arise from asynchronous branch predictor operations that race against other events, such as privilege domain transitions and prediction invalidation, leading to violations of hardware-enforced privilege and context separation mechanisms.
• Asynchronous Branch Predictor Updates (ABPU) on Intel: A key discovery is that on Intel CPUs, branch predictions are inserted into the predictor after the respective branch instructions have retired. Crucially, these updates are independent of dispatch serializing instructions like lfence and can take hundreds of cycles. This phenomenon, termed Asynchronous Branch Predictor Updates (ABPU), creates a temporal window for race conditions. ABPU was observed on all evaluated Intel microarchitectures but not on AMD or ARM processors.
• eIBRS Failure and BPRC Variants: The study conclusively demonstrates that Intel's eIBRS mitigation fails to correctly restrict branch target predictions originating immediately before a privilege domain change. This constitutes a direct violation of eIBRS security guarantees. Three concrete variants of BPRC were identified:
• BPRCU→K: User-to-kernel privilege boundary bypass, allowing injection of branch predictions from user mode into the kernel.
• BPRCG→H: Guest-to-hypervisor privilege boundary bypass, allowing injection from a guest VM into the hypervisor.
• BPRCIBPB: Bypass of the Indirect Branch Prediction Barrier (IBPB), demonstrating that even this explicit barrier is not always synchronized with BPU updates on most Intel microarchitectures.
• Branch Privilege Injection (BPI) Primitive: Leveraging the BPRCU→K variant, the researchers developed Branch Privilege Injection (BPI). This new BTI primitive enables an unprivileged attacker to inject arbitrary indirect branch target predictions that are tagged with kernel privilege, effectively resurrecting cross-privilege BTI attacks.
• BTB as the Culprit: Through innovative reverse engineering techniques that distinguish between BTB and IBP predictions based on their partial vs. full target addresses, the researchers pinpointed the BTB as the exclusive source of all observed eIBRS security violations.
• Persistence of Corrupted Predictions: The inconsistent privilege domain restrictions associated with branch predictions are not transient. Once a corrupted prediction is learned, it persists indefinitely in the BTB until overwritten or evicted, making the attack highly reliable.
• Inadvertent Aid from BHI_DIS_S: Intel's BHI_DIS_S speculation control, designed to mitigate Branch History Injection (BHI) attacks, was found to inadvertently improve the reliability of BPI. This is because BHI_DIS_S disables the path-based IBP entirely in kernel mode on Golden Cove, Raptor Cove, and Gracemont cores, forcing indirect branches to rely on the vulnerable BTB.
• Widespread Impact: BPRC is not a newly introduced vulnerability; it is present across at least six different generations of Intel processor microarchitectures, specifically all eIBRS-enabled CPUs since Spectre v2 hardware mitigations were first introduced.
• Responsible Disclosure and CVE: The vulnerability was responsibly disclosed to Intel PSIRT in September 2024, leading to the assignment of CVE-2024-45332. Intel confirmed the findings and indicated that a microcode update is required for full mitigation. AMD and ARM processors were assessed and appear not to be affected.
• End-to-End Exploitation: An end-to-end BPI exploit was successfully demonstrated on Intel Raptor Cove, leaking arbitrary kernel memory from up-to-date Linux systems (kernel version 6.8.0-47-generic) at a rate of 5.6 KiB/s with 99.8% accuracy. The exploit could leak the root password hash from /etc/shadow within 21 seconds with 90.7% success.

Technical Deep Dive

The core of Branch Predictor Race Conditions (BPRC) lies in the asynchronous nature of Intel's Branch Prediction Unit (BPU) operations, particularly how branch target predictions are updated and associated with privilege domains. Unlike many other CPU operations, BPU updates are not strictly synchronized with the instruction stream or dispatch-serializing instructions like lfence. This leads to a crucial temporal window where a branch prediction, learned in one privilege domain, might be inserted into the predictor after a privilege transition, thereby acquiring the wrong privilege tag.

The researchers' first challenge (C1) was to explore this asynchronous behavior. They designed an experiment (Figure 2, Figure 3) where the same branch instruction was executed twice (B1, B2) with a variable delay (d NOPs) in between, following an initial misprediction for B1. By measuring the average mispredictions for B2, they observed that on Intel CPUs, even with lfence instructions between B1 and B2, a significant delay (hundreds of cycles) was required before B2 was correctly predicted. This confirmed that branch predictions are inserted after branch instructions retire and independently of dispatch-serializing instructions, a phenomenon termed Asynchronous Branch Predictor Updates (ABPU). This ABPU was consistently observed across Intel microarchitectures but not on AMD or ARM.

Building on ABPU, the critical hypothesis emerged: if privilege domain state is gathered at prediction insertion time rather than at branch retirement time, a race condition could lead to incorrect privilege tagging during a domain transition. To test this, an experiment was devised (Figure 4) for BPRCU→K. A branch was trained in user mode to a cache-signaling gadget. Immediately after, a syscall instruction triggered a privilege transition to supervisor mode. The same branch was then executed again in supervisor mode with a different target. If a cache hit from the user-mode trained gadget was observed in supervisor mode, it indicated an eIBRS violation. The results (Table 2) showed consistent cache signals above noise on all eIBRS-enabled Intel parts, confirming that eIBRS fails to correctly restrict branch target predictions originating just before a privilege domain change. Similar experiments confirmed BPRCG→H (guest-to-hypervisor via vmcall, cpuid, or page faults) and BPRCIBPB (IBPB bypass via MSR write in kernel mode).

The second challenge (C2) was to understand the precise conditions for exploiting BPRCU→K. This required distinguishing between BTB and IBP predictions. The key insight (Figure 5) is that the BTB typically provides only a partial target address (e.g., lower 32 bits), while the IBP provides a full 48-bit target. By crafting training and victim branch sources and targets with distinct upper 16 bits but aliasing lower bits, the researchers could make BTB and IBP predictions result in observably different targets. Repeating the BPRCU→K experiment with this distinction, they found that all observed eIBRS security violations originated from the BTB, making it the primary target for Branch Privilege Injection (BPI).

Further analysis refined the BPI primitive. An experiment (Figure 7, Figure 8) investigated the temporal proximity dependency between the training branch (B1) and the syscall instruction. It was found that the syscall needed to occur within a specific time window (300-400 NOPs delay) for the prediction to be associated with the kernel privilege. However, once the corrupted prediction was learned, it persisted indefinitely in the BTB, making the violation independent of the temporal proximity between the training and victim branches (Observation O6).

The third challenge (C3) addressed making BPI repeatable in a realistic setting. In a kernel environment, uncontrolled preceding branches can fill the BHB, leading to IBP hits that take precedence over the vulnerable BTB. This would reduce BPI's effectiveness. Surprisingly, Intel's BHI_DIS_S speculation control, designed to mitigate Branch History Injection (BHI), was found to significantly improve BPI reliability (Figure 9). Through reverse engineering (Table 3), the researchers discovered that BHI_DIS_S on Golden Cove, Raptor Cove, and Gracemont cores completely disables path-based indirect branch prediction (IBP) in kernel mode. This forces kernel indirect branches to rely solely on the BTB, which is susceptible to BPI, thereby inadvertently enhancing the attack's effectiveness. This observation (O7) underscores how mitigations against one class of attacks can sometimes create new vulnerabilities or improve others.

The threat model assumed a local attacker with unprivileged code execution on an up-to-date Linux kernel (Ubuntu 24.04, kernel 6.8.0-47-generic) with all default mitigations enabled (including SMEP and SMAP). The attacker's goal was to leak arbitrary privileged memory by hijacking speculative control flow, even with defenses like eIBRS, AutoIBRS, and CSV2.

Demo / Proof of Concept

To demonstrate the practical impact of the Branch Privilege Injection (BPI) primitive, the researchers developed an end-to-end exploit capable of leaking arbitrary kernel memory from a fully up-to-date Linux system. This proof of concept was executed on an Intel Raptor Lake processor running Ubuntu 24.04 with kernel version 6.8.0-47-generic, and all default security mitigations against CPU vulnerabilities were enabled. The exploit successfully addresses four key challenges to achieve its objective.

1. Achieving a Repeatable BPI Primitive: As identified in the technical deep dive, the Branch Target Buffer (BTB) is the vulnerable component, but the Indirect Branch Predictor (IBP) typically takes precedence if it has a hit. To ensure repeatable BPI, the IBP needs to be bypassed. The research found that Intel's BHI_DIS_S speculation control, enabled by default in Linux to prevent Branch History Injection (BHI) attacks, inadvertently disables the IBP entirely in kernel mode on Golden Cove, Raptor Cove, and Gracemont cores (Observation O7). This forces kernel indirect branches to rely solely on the BTB, making BPI highly reliable and repeatable, as shown by improved success rates in Figure 9-right.

1. Injecting a Kernel Branch Target: Due to SMEP being enabled, the exploit cannot simply inject a user-mode target. Instead, it must inject a kernel target. BPI leverages the fact that the BTB stores only partial target addresses. The attacker trains a user-mode branch to an address whose lower portion matches the desired kernel target. When a victim branch in the kernel executes, its source address (which is in the kernel address range) provides the upper bits, completing the target address into a full kernel address, effectively redirecting speculative execution within the kernel.

1. Finding Speculation and Disclosure Gadgets:

• Speculation Gadget: This is a victim indirect branch in the kernel that can be influenced by BPI. The gadget needs attacker-controllable secret and reload buffer pointers, typically passed as system call arguments. The researchers identified a suitable gadget within the __keyctl_read_key function (Listing 2) in the Linux kernel. This function contains a function-pointer call (the victim branch) where arguments buffer (in r13) and buflen (in r12) are directly controllable by the attacker via system call arguments. The chain of pointer dereferences involved helps create a long transient execution window.
• Disclosure Gadget: This gadget speculatively executes after the victim branch to leak secret data via a Flush+Reload side channel. It needs to use the two attacker-controlled registers (from the speculation gadget) to access a reload buffer with a secret-dependent offset. The ideal gadget would multiply the secret by 4096 to avoid hardware prefetchers, but a suitable gadget was found in the Linux kernel's ZSTD compression code: HUF_compress1X_usingCTable_internal_default (Listing 3). This gadget dereferences one byte from r12 (the secret pointer), uses it as an offset to r13 (the reload buffer pointer), and dereferences the resulting address. This allows the secret to be deduced by offsetting the reload buffer pointer until the access lands in a consecutive page.

1. Breaking KASLR: Kernel Address Space Layout Randomization (KASLR) randomizes kernel memory regions, which must be derandomized to locate gadgets and the reload buffer.

• Kernel Image: KASLR randomizes the kernel image base with 9 bits of entropy. The exploit uses BTB collisions to derandomize this. By training an indirect branch with BPI to a target containing a second branch, and checking if this second branch overwrites a user-space aliasing branch's prediction, the attacker can guess the correct kernel base. This involves iterating through possible kernel image locations and detecting BTB updates.
• Reload Buffer (Physmap): The attacker maps the reload buffer to a Transparent Huge Page (THP), reducing its possible locations significantly. First, the physical address (physmap offset) of the reload buffer is found. Since the kernel image base is known, a pointer to page_offset_base is available. By passing this address in r13 to a different disclosure gadget (Listing 4) that loads a 64-bit value, the physmap pointer can be retrieved. Combining this with an attacker-controlled offset in r12, the attacker scans physmap to find the reload buffer's offset. Finally, by testing all 15 bits of entropy for the physmap base address with the known reload buffer offset, KASLR for the physmap region is broken.

Performance and End-to-End Leakage:

The KASLR derandomization achieved a median time of 15ms for the kernel image (98.4% accuracy) and 21ms/102ms for the reload buffer and physmap locations respectively (98.2% accuracy) over 1000 executions. The arbitrary memory leak primitive demonstrated a median bandwidth of 5.6 KiB/s with 99.8% byte-accuracy for a 1 MiB kernel-allocated buffer. The full end-to-end exploit, leaking the root password hash from /etc/shadow, completed with a median time of 21 seconds, successfully leaking the full hash in 90.7% of runs, with at most 6 errors in 97.9% of runs.

This practical exploitation confirms that BPI effectively bypasses state-of-the-art hardware and software mitigations, enabling high-bandwidth, high-accuracy arbitrary kernel memory leakage from an unprivileged user process.

Defensive Implications

The discovery of Branch Predictor Race Conditions (BPRC) and the Branch Privilege Injection (BPI) primitive highlights a critical vulnerability in the hardware-enforced eIBRS mitigation on modern Intel processors, compromising its security guarantees. Defenders must take immediate action to address this new class of transient execution attacks.

Several mitigation strategies were proposed and evaluated:

1. Retpoline with RRSBA_DIS_S:

• Mechanism: Retpoline replaces indirect branches in executables with sequences that force mispredictions, eliminating the vulnerable indirect branch targets. For comprehensive protection, this should be combined with the RRSBA_DIS_S speculation control, which disables RSBA (Return Stack Buffer Alternate) predictions in supervisor mode, guarding against vulnerable return predictions under RSB underflow.
• Effectiveness: Empirically validated to eliminate cache gadget hits from BPRCU→K through RSBA.
• Overhead: Up to 3.1% in UnixBench and 8.3% in lmbench. While effective, this is a relatively high performance penalty. Older processors (Rocket Lake, Comet Lake, Coffee Lake Refresh) may not support RRSBA_DIS_S but might not be affected by RSBA-related BPRCU→K due to microarchitectural differences.
• Considerations: This approach assumes that mispredicted direct branches do not introduce new side-channel observable effects, an assumption that might be challenged in future research.

1. IPRED_DIS_S (Indirect Branch Prediction Disable in Supervisor Mode):

• Mechanism: This supplementary speculation control, available on newer Intel CPUs, prevents speculative execution at the predicted target of indirect jumps, indirect calls, and RSBA-predicted returns until the target is resolved. Essentially, it disables all indirect branch prediction in supervisor mode.
• Effectiveness: Empirically verified to completely eliminate cache gadget hits on all supported microarchitectures.
• Overhead: Significantly lower than Retpoline, up to 1.7% in UnixBench and 6.4% in lmbench.
• Considerations: This is a strong mitigation as it completely removes the speculative path for indirect branches in the kernel, but it is only available on newer processors.

1. IBPB (Indirect Branch Prediction Barrier):

• Mechanism: The IBPB instruction is designed to invalidate all indirect branch target predictions.
• Effectiveness: The research explicitly found that IBPB is not a viable mitigation against BPRC, as it can be bypassed by BPRCIBPB (Section 5.3). This means IBPB itself is susceptible to race conditions and cannot guarantee sanitization of the branch predictor state.

1. Intel Microcode Update (CVE-2024-45332):

• Mechanism: Intel, upon responsible disclosure, confirmed the need for a microcode update for an in-depth mitigation of BPRC. This update is crucial for fixing BPRCIBPB and addressing potential other variants.
• Effectiveness: A pre-release microcode update for Alder Lake processors successfully eliminated all three BPRC variants discussed in the paper.
• Overhead: The evaluated microcode update showed an overhead of 1.4% in UnixBench and 2.7% in lmbench, which is the lowest overhead among the evaluated mitigations.
• Recommendation: This is the most comprehensive and recommended mitigation, addressing the root cause at the hardware level. Users and system administrators should prioritize applying this microcode update as soon as it is released by Intel.

Other Considerations:

• AMD and ARM Processors: The research indicates that AMD and ARM processors (Zen 4, Zen 5, Cortex-X1, Cortex-A76) appear not to be affected by BPRC, as they did not exhibit ABPU (Asynchronous Branch Predictor Updates). This suggests their branch predictor update mechanisms are more synchronized or handle privilege transitions differently.
• BHI_DIS_S Interaction: It's important to note that BHI_DIS_S, a mitigation against Branch History Injection (BHI), paradoxically improves the reliability of BPI by disabling the IBP in kernel mode. This highlights the complex interplay between different microarchitectural mitigations and the potential for unintended consequences. Defenders should be aware that enabling one mitigation might alter the threat landscape for others.

In summary, while software-based mitigations like Retpoline and IPRED_DIS_S can offer protection, the most effective and least impactful solution is the Intel-provided microcode update for CVE-2024-45332. System administrators must ensure their systems are updated with the latest microcode as soon as it becomes available to fully address this critical vulnerability.

Key Takeaways

• BPRC is a New Class of Microarchitectural Vulnerability: Branch Predictor Race Conditions (BPRC) represent a novel class of vulnerabilities on Intel CPUs, where asynchronous branch predictor updates race against critical events like privilege domain transitions and prediction invalidation.
• Bypasses Hardware Mitigations: BPRC directly compromises eIBRS (enhanced Indirect Branch Restricted Speculation) and can even bypass the Indirect Branch Prediction Barrier (IBPB), allowing less privileged predictions to be used in more privileged contexts (user-to-kernel, guest-to-hypervisor).
• Branch Privilege Injection (BPI) for Arbitrary Code Injection: Leveraging BPRCU→K, the Branch Privilege Injection (BPI) primitive enables an unprivileged attacker to inject arbitrary branch predictions tagged with kernel privilege from user mode, resurrecting Spectre v2-like cross-privilege attacks.
• Widespread Impact and End-to-End Exploitation: BPRC affects all Intel CPUs with eIBRS-enabled branch predictors across at least six generations. An end-to-end BPI exploit was demonstrated to leak arbitrary kernel memory at 5.6 KiB/s with 99.8% accuracy, capable of extracting the root password hash from /etc/shadow in 21 seconds.
• Intel Microcode Update is Crucial: The vulnerability, assigned CVE-2024-45332, requires a microcode update from Intel for a full and comprehensive mitigation, which has shown to be effective and have a low overhead (1.4% UnixBench / 2.7% lmbench).
• AMD and ARM Processors Appear Unaffected: Extensive evaluation found no observable Asynchronous Branch Predictor Updates (ABPU) or BPRC issues on tested AMD (Zen 4, Zen 5) and ARM (Cortex-X1, Cortex-A76) processors.

About the Speaker(s)

The research presented in this paper was conducted by a team from ETH Zurich:

• Sandro Rüegge: Affiliated with ETH Zurich.
• Johannes Wikner: Affiliated with ETH Zurich.
• Kaveh Razavi: Affiliated with ETH Zurich.

Their work contributes significantly to the field of hardware security, particularly in understanding and mitigating microarchitectural vulnerabilities.