New Spectre-v2 Variant Uses JIT Compiler Branch Target Reuse for Cross-Process Data Extraction

Researchers from the Netherlands and Italy have published a scientific paper describing a new attack belonging to the Spectre-v2 class. The original Spectre-v2 technique, demonstrated in 2018, exploits the branch prediction mechanisms in modern CPUs to execute a chosen malicious instruction and then read its results from cache via a side channel.

The new research replaces instruction injection with a method that reuses existing information inside the branch predictor. The required Branch Target Reuse state is created by the operation of a JIT compiler, a scenario previously considered impractical for attacks. The published study demonstrates successful secret extraction when branch prediction features are combined with the cBPF JIT compiler present in the Linux kernel.

The same researchers also examined the SpiderMonkey JIT compiler used in Firefox and the GraalVM engine. The JIT compiler was employed to train the branch predictor, while the actual attack became possible when different code was loaded at the same memory addresses. This created conditions for speculative execution that granted access to secret data.

A practical demonstration targeted the su process on Linux and extracted the hashed root password from CPU cache. The required result was achieved in an average of three to five minutes, which is relatively fast for complex Spectre-class attacks. A full attack was shown using the cBPF compiler. With SpiderMonkey and GraalVM only partial success was recorded: branch predictor training was possible, yet realistic attacks could not be demonstrated.

The researchers confirmed that the attack works on all major modern CPU types, including AMD, Intel, and ARM architectures.

What else happened

Specialists from Kaspersky published an analysis of methods for detecting traces of attacks against 1C servers, extending their earlier research on real incidents. Last week Debian released a record kernel update addressing more than 1,300 vulnerabilities. Dangerous flaws were found in both client and server components of TeamViewer. A zero-day vulnerability in Core Graphics was fixed in iOS and macOS updates. Google closed its bug bounty program for open-source projects it supports due to the large volume of automatically generated reports produced by AI assistants. Critical vulnerabilities were also disclosed in Dell Container Storage Modules, including two issues with a maximum CVSS score of 10 that allow authentication bypass.