The new Retbleed speculative execution attack impacts both Intel and AMD chips

Researchers warn of a new vulnerability, dubbed Retbleed, that impacts multiple older AMD and Intel microprocessors.

ETH Zurich researchers Johannes Wikner and Kaveh Razavi discovered a new vulnerability, dubbed Retbleed, that affects multiple older AMD and Intel microprocessors. An attacker can exploit the flaw to bypass current defenses and perform in Spectre-based attacks.

The Retbleed vulnerability is tracked as CVE-2022-29900 (AMD) and CVE-2022-29901 (Intel).

“Retbleed (CVE-2022-29900 and CVE-2022-29901) is the new addition to the family of speculative execution attacks that exploit branch target injection to leak information, which we call Spectre-BTI. Unlike its siblings, who trigger harmful branch target speculation by exploiting indirect jumps or calls, Retbleed exploits return instructions.” reads the report about this issue. “This means a great deal, since it undermines some of our current Spectre-BTI defenses.”

Experts pointed out that many operating systems use a defense mechanism called retpoline, which works by replacing indirect jumps and calls with returns. Retpolines were first devised in 2018 to prevent Spectre-BTI attacks. The experts discovered that it is possible to exploit return instructions as an attack vector for speculation execution and predict the statements like indirect branches.

However, experts discovered that it is possible to exploit Retbleed due to the following issues:

• It is possible to trigger the microarchitectural conditions, on both AMD and Intel CPUs, that forces returns to be predicted like indirect branches. The experts developed custom tools to discover locations in the Linux kernel where these conditions are met.
• it is possible to inject branch targets that reside inside the kernel address-space, even as an unprivileged user. Even though we cannot access branch targets inside the kernel address-space — branching to such a target results in a page fault — the Branch Prediction Unit will update itself upon observing a branch and assume that it was legally executed, even if it’s to a kernel address.

“Intel. On Intel, returns start behaving like indirect jumps when the Return Stack Buffer, which holds return target predictions, is underflowed. This happens upon executing deep call stacks. In our evaluation, we found over a thousand of such conditions that can be triggered by a system call. The indirect branch target predictor for Intel CPUs has been studied in previous work.” explained the experts. “AMD. On AMD, returns will behave like an indirect branch regardless of the state of their Return Address Stack. In fact, by poisoning the return instruction using an indirect jump, the AMD branch predictor will assume that it will encounter an indirect jump instead of a return and consequentially predict an indirect branch target. This means that any return that we can reach through a system call can be exploited — and there are tons of them.”

Both Intel ([1] [2]) and AMD chipmakers addressed the issue with the release of software patches.

Below is a video PoC of Retbleed leaking kernel memory on Intel and AMD CPUs:

The experts published a research paper about Retbleed that will be presented at USENIX Security 2022. You can find the source code of Retbleed on our Github..

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, chip)

[adrotate banner=”5″]

[adrotate banner=”13″]