CVE-2024-2201

Published: 9 April 2024

[x86: Native Branch History Injection]

From the Ubuntu Security Team

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the first Branch History Injection publication were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information.

Notes

in the short term, Ubuntu 6.6 based kernels (Ubuntu 23.10
LTS and Ubuntu 22.04 HWE kernels) have backported the first round of
native_bhi mitigations, but are defaulting to spectre_bhi=auto. The
kernel commandline parameter can be changed to spectre_bhi=on if
desired; see the kernel parameters documentation linked to in the
references section.  This default will change to match the upstream
kernel's default to "on" in a subsequent update.

Status

References

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2bb69f5fc72183e1c62547d900f560d0e9334925
• https://www.vusec.net/projects/native-bhi/
• https://lists.xenproject.org/archives/html/xen-announce/2024-04/msg00004.html
• https://download.vusec.net/papers/inspectre_sec24.pdf
• https://www.cve.org/CVERecord?id=CVE-2024-2201
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/admin-guide/kernel-parameters.txt?id=2bb69f5fc72183e1c62547d900f560d0e9334925#n6066
• https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Native-BHI
• NVD
• Launchpad
• Debian