Johannes Wikner

A flaw in the Core component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. This issue can lead to unauthorized access to critical data or complete access to all accessible data within the environment. The attack may also significantly impact additional products due to a scope change.

A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. The vulnerability, also known as Inception, is a novel transient execution attack that leaks arbitrary data on all AMD Zen CPUs in the presence of all previously deployed software- and hardware mitigations.

The issue is related to aliases in the branch predictor of some AMD processors, which may cause them to predict the wrong branch type. This could potentially lead to information disclosure. The vulnerability is associated with incorrect branch type prediction, allowing an attacker to disclose protected information.

The issue is related to mis-trained branch predictions for return instructions, which may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. This can lead to the disclosure of protected information from kernel memory or enable an attack on the host system from virtual machines. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution.

The issue is related to errors in processing the `ret` instruction, which retrieves an address for transition from the stack. This can allow an attacker to disclose protected information from kernel memory or launch an attack on the host system from virtual machines. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions.

The issue is related to an unprotected alternative channel of return branch target prediction in some Intel(R) Processors, which may allow an authorized user to potentially enable information disclosure via local access. The RSBA behavior allows alternate branch predictors to be used by near RET instructions when the RSB is empty. When eIBRS is enabled, the predicted target of these alternate predictors are restricted to those belonging to the indirect branch predictor entries of the current prediction domain.