Linux Kernel Patched For "PBRSB" After Intel eIBRS CPUs Found To Be Insufficient
Hitting the mainline Linux kernel a few minutes ago was the x86_bugs_pbrsb pull as part of Patch Tuesday.
This security change is summed up as:
More from the CPU vulnerability nightmares front:
Intel eIBRS machines do not sufficiently mitigate against RET mispredictions when doing a VM Exit therefore an additional RSB, one-entry stuffing is needed.
The Linux kernel via its vulnerabilities reporting will now indicate if a system is vulnerable to EIBRS Post-barrier Return Stack Buffer (PBRSB), whether the system is running with protection of RSB on VMEXITs, or if the system is not affected. The kernel change adds an LFENCE to the return stack buffer (RSB) fill sequence and adds RSB VMEXIT protections. The kernel patch treats all Intel eIBRS-using CPUs as needing PBRSB handling except for Goldmont Plus and Tremont.
EIBRS is for the Enhanced Indirect Branch Restricted Speculation and is used by newer Intel CPUs as part of their Spectre V2 mitigation. eIBRS remains in place through the latest 12th Gen "Alder Lake" processors, so presumably given these kernel comments will mean the very latest Intel CPUs will now apply this PBRSB behavior when running on a patched kernel.
The PBRSB patch is now in Linux 6.0 Git mainline while will work its way back to the stable Linux kernel series shortly... With this being a matter of Intel eIBRS being insufficient, other operating systems will presumably need to be updated handling too with this not being a Linux-specific item. I'll be running some more tests locally and further exploring PBRSB.
9 Comments
