Rodrigo Branco

O problema está relacionado à execução especulativa de operações de leitura e gravação, acessando a memória por meio de endereços não canônicos. Isso pode potencialmente resultar em vazamento de dados. A vulnerabilidade pode permitir que um invasor divulgue informações sobre o espaço de endereços do kernel usando um ataque de canal lateral. O problema é semelhante à vulnerabilidade Meltdown. Pesquisadores demonstraram a eficácia do ataque, e estima-se que ele afete várias CPUs, incluindo CPUs AMD existentes e futuras CPUs Intel e Arm.

The issue is related to Microarchitectural Data Sampling Uncacheable Memory (MDSUM) on some microprocessors that utilize speculative execution. This may allow an authenticated user with local access to potentially enable information disclosure via a side channel. An attacker with local access to a targeted system may exploit this issue to obtain data on the targeted system, causing some information leakage.

The issue is related to Microarchitectural Load Port Data Sampling (MLPDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the incorrect implementation of saving outdated operation results in the load port table. The exploitation of this issue can allow an attacker to access confidential information.

The issue is related to Microarchitectural Fill Buffer Data Sampling (MFBDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the speculative execution utilized by some microprocessors.

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The `ib prctl set` function updates the Thread Information Flags (TIFs) for the task and updates the SPEC CTRL MSR on the function ` speculation ctrl update`, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall.