Researchers from the Netherlands and Italy identified a new Spectre v2 variant, dubbed Branch Target Reuse (BTR), affecting Intel, AMD, and Arm processors. The vulnerability exploits JIT compilers by reusing stale branch prediction entries, allowing unauthorized access to sensitive data like password hashes.
The team developed two exploits for the Linux kernel targeting the cBPF subsystem, which is accessible to non-privileged users. On Intel processors, these exploits can bypass existing security mechanisms to read arbitrary memory, achieving data exfiltration speeds of 8 bytes per second.
The vulnerability also impacts the SpiderMonkey engine in Firefox and Oracle GraalVM. While a full browser-based exploit is not yet available, researchers demonstrated that stale branch records in SpiderMonkey can be leveraged to leak data from browser tabs.
Software vendors have acknowledged the findings. Linux developers implemented IBPB-based protections for the x86 architecture, while Oracle has deployed security patches. Mozilla is focusing on site isolation to mitigate risks, though full implementation is pending.
Hardware-based control-flow protections like IBT on x86 and BTI on Arm complicate exploitation but do not fully eliminate the threat. Only Intel's Lion Cove architecture, found in Core Ultra 200 series chips, appears to address the underlying behavior.
