요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
RSB underflow
rsb.rst:146-220Intel RSBA·RRSBA, BTB fallback, BHB clear와 retpoline 요구 사항을 설명합니다.
참고 자료
rsb.rst:221-268원문의 architecture guidance와 논문 링크를 모두 제공합니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
1
.. SPDX-License-Identifier: GPL-2.0
3
=======================
4
RSB-related mitigations
5
=======================
7
.. warning::
8
Please keep this document up-to-date, otherwise you will be
9
volunteered to update it and convert it to a very long comment in
10
bugs.c!
12
Since 2018 there have been many Spectre CVEs related to the Return Stack
13
Buffer (RSB) (sometimes referred to as the Return Address Stack (RAS) or
14
Return Address Predictor (RAP) on AMD).
16
Information about these CVEs and how to mitigate them is scattered
17
amongst a myriad of microarchitecture-specific documents.
19
This document attempts to consolidate all the relevant information in
20
once place and clarify the reasoning behind the current RSB-related
21
mitigations. It's meant to be as concise as possible, focused only on
22
the current kernel mitigations: what are the RSB-related attack vectors
23
and how are they currently being mitigated?
25
It's *not* meant to describe how the RSB mechanism operates or how the
26
exploits work. More details about those can be found in the references
27
below.
29
Rather, this is basically a glorified comment, but too long to actually
30
be one. So when the next CVE comes along, a kernel developer can
31
quickly refer to this as a refresher to see what we're actually doing
32
and why.
34
At a high level, there are two classes of RSB attacks: RSB poisoning
35
(Intel and AMD) and RSB underflow (Intel only). They must each be
36
considered individually for each attack vector (and microarchitecture
37
where applicable).
39
----
41
RSB poisoning (Intel and AMD)
42
=============================
44
SpectreRSB
45
~~~~~~~~~~
47
RSB poisoning is a technique used by SpectreRSB [#spectre-rsb]_ where
48
an attacker poisons an RSB entry to cause a victim's return instruction
49
to speculate to an attacker-controlled address. This can happen when
50
there are unbalanced CALLs/RETs after a context switch or VMEXIT.
52
* All attack vectors can potentially be mitigated by flushing out any
53
poisoned RSB entries using an RSB filling sequence
54
[#intel-rsb-filling]_ [#amd-rsb-filling]_ when transitioning between
55
untrusted and trusted domains. But this has a performance impact and
56
should be avoided whenever possible.
58
.. DANGER::
59
**FIXME**: Currently we're flushing 32 entries. However, some CPU
60
models have more than 32 entries. The loop count needs to be
61
increased for those. More detailed information is needed about RSB
62
sizes.
64
* On context switch, the user->user mitigation requires ensuring the
65
RSB gets filled or cleared whenever IBPB gets written [#cond-ibpb]_
66
during a context switch:
68
* AMD:
69
On Zen 4+, IBPB (or SBPB [#amd-sbpb]_ if used) clears the RSB.
70
This is indicated by IBPB_RET in CPUID [#amd-ibpb-rsb]_.
72
On Zen < 4, the RSB filling sequence [#amd-rsb-filling]_ must be
73
always be done in addition to IBPB [#amd-ibpb-no-rsb]_. This is
74
indicated by X86_BUG_IBPB_NO_RET.
76
* Intel:
77
IBPB always clears the RSB:
79
"Software that executed before the IBPB command cannot control
80
the predicted targets of indirect branches executed after the
81
command on the same logical processor. The term indirect branch
82
in this context includes near return instructions, so these
83
predicted targets may come from the RSB." [#intel-ibpb-rsb]_
85
* On context switch, user->kernel attacks are prevented by SMEP. User
86
space can only insert user space addresses into the RSB. Even
87
non-canonical addresses can't be inserted due to the page gap at the
88
end of the user canonical address space reserved by TASK_SIZE_MAX.
89
A SMEP #PF at instruction fetch prevents the kernel from speculatively
90
executing user space.
92
* AMD:
93
"Finally, branches that are predicted as 'ret' instructions get
94
their predicted targets from the Return Address Predictor (RAP).
95
AMD recommends software use a RAP stuffing sequence (mitigation
96
V2-3 in [2]) and/or Supervisor Mode Execution Protection (SMEP)
97
to ensure that the addresses in the RAP are safe for
98
speculation. Collectively, we refer to these mitigations as "RAP
99
Protection"." [#amd-smep-rsb]_
101
* Intel:
102
"On processors with enhanced IBRS, an RSB overwrite sequence may
103
not suffice to prevent the predicted target of a near return
104
from using an RSB entry created in a less privileged predictor
105
mode. Software can prevent this by enabling SMEP (for
106
transitions from user mode to supervisor mode) and by having
107
IA32_SPEC_CTRL.IBRS set during VM exits." [#intel-smep-rsb]_
109
* On VMEXIT, guest->host attacks are mitigated by eIBRS (and PBRSB
110
mitigation if needed):
112
* AMD:
113
"When Automatic IBRS is enabled, the internal return address
114
stack used for return address predictions is cleared on VMEXIT."
115
[#amd-eibrs-vmexit]_
117
* Intel:
118
"On processors with enhanced IBRS, an RSB overwrite sequence may
119
not suffice to prevent the predicted target of a near return
120
from using an RSB entry created in a less privileged predictor
121
mode. Software can prevent this by enabling SMEP (for
122
transitions from user mode to supervisor mode) and by having
123
IA32_SPEC_CTRL.IBRS set during VM exits. Processors with
124
enhanced IBRS still support the usage model where IBRS is set
125
only in the OS/VMM for OSes that enable SMEP. To do this, such
126
processors will ensure that guest behavior cannot control the
127
RSB after a VM exit once IBRS is set, even if IBRS was not set
128
at the time of the VM exit." [#intel-eibrs-vmexit]_
130
Note that some Intel CPUs are susceptible to Post-barrier Return
131
Stack Buffer Predictions (PBRSB) [#intel-pbrsb]_, where the last
132
CALL from the guest can be used to predict the first unbalanced RET.
133
In this case the PBRSB mitigation is needed in addition to eIBRS.
135
AMD RETBleed / SRSO / Branch Type Confusion
136
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
138
On AMD, poisoned RSB entries can also be created by the AMD RETBleed
139
variant [#retbleed-paper]_ [#amd-btc]_ or by Speculative Return Stack
140
Overflow [#amd-srso]_ (Inception [#inception-paper]_). The kernel
141
protects itself by replacing every RET in the kernel with a branch to a
142
single safe RET.
144
----
146
RSB underflow (Intel only)
147
==========================
149
RSB Alternate (RSBA) ("Intel Retbleed")
150
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
152
Some Intel Skylake-generation CPUs are susceptible to the Intel variant
153
of RETBleed [#retbleed-paper]_ (Return Stack Buffer Underflow
154
[#intel-rsbu]_). If a RET is executed when the RSB buffer is empty due
155
to mismatched CALLs/RETs or returning from a deep call stack, the branch
156
predictor can fall back to using the Branch Target Buffer (BTB). If a
157
user forces a BTB collision then the RET can speculatively branch to a
158
user-controlled address.
160
* Note that RSB filling doesn't fully mitigate this issue. If there
161
are enough unbalanced RETs, the RSB may still underflow and fall back
162
to using a poisoned BTB entry.
164
* On context switch, user->user underflow attacks are mitigated by the
165
conditional IBPB [#cond-ibpb]_ on context switch which effectively
166
clears the BTB:
168
* "The indirect branch predictor barrier (IBPB) is an indirect branch
169
control mechanism that establishes a barrier, preventing software
170
that executed before the barrier from controlling the predicted
171
targets of indirect branches executed after the barrier on the same
172
logical processor." [#intel-ibpb-btb]_
174
* On context switch and VMEXIT, user->kernel and guest->host RSB
175
underflows are mitigated by IBRS or eIBRS:
177
* "Enabling IBRS (including enhanced IBRS) will mitigate the "RSBU"
178
attack demonstrated by the researchers. As previously documented,
179
Intel recommends the use of enhanced IBRS, where supported. This
180
includes any processor that enumerates RRSBA but not RRSBA_DIS_S."
181
[#intel-rsbu]_
183
However, note that eIBRS and IBRS do not mitigate intra-mode attacks.
184
Like RRSBA below, this is mitigated by clearing the BHB on kernel
185
entry.
187
As an alternative to classic IBRS, call depth tracking (combined with
188
retpolines) can be used to track kernel returns and fill the RSB when
189
it gets close to being empty.
191
Restricted RSB Alternate (RRSBA)
192
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
194
Some newer Intel CPUs have Restricted RSB Alternate (RRSBA) behavior,
195
which, similar to RSBA described above, also falls back to using the BTB
196
on RSB underflow. The only difference is that the predicted targets are
197
restricted to the current domain when eIBRS is enabled:
199
* "Restricted RSB Alternate (RRSBA) behavior allows alternate branch
200
predictors to be used by near RET instructions when the RSB is
201
empty. When eIBRS is enabled, the predicted targets of these
202
alternate predictors are restricted to those belonging to the
203
indirect branch predictor entries of the current prediction domain.
204
[#intel-eibrs-rrsba]_
206
When a CPU with RRSBA is vulnerable to Branch History Injection
207
[#bhi-paper]_ [#intel-bhi]_, an RSB underflow could be used for an
208
intra-mode BTI attack. This is mitigated by clearing the BHB on
209
kernel entry.
211
However if the kernel uses retpolines instead of eIBRS, it needs to
212
disable RRSBA:
214
* "Where software is using retpoline as a mitigation for BHI or
215
intra-mode BTI, and the processor both enumerates RRSBA and
216
enumerates RRSBA_DIS controls, it should disable this behavior."
217
[#intel-retpoline-rrsba]_
219
----
221
References
222
==========
224
.. [#spectre-rsb] `Spectre Returns! Speculation Attacks using the Return Stack Buffer <https://arxiv.org/pdf/1807.07940.pdf>`_
226
.. [#intel-rsb-filling] "Empty RSB Mitigation on Skylake-generation" in `Retpoline: A Branch Target Injection Mitigation <https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/retpoline-branch-target-injection-mitigation.html#inpage-nav-5-1>`_
228
.. [#amd-rsb-filling] "Mitigation V2-3" in `Software Techniques for Managing Speculation <https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/software-techniques-for-managing-speculation.pdf>`_
230
.. [#cond-ibpb] Whether IBPB is written depends on whether the prev and/or next task is protected from Spectre attacks. It typically requires opting in per task or system-wide. For more details see the documentation for the ``spectre_v2_user`` cmdline option in Documentation/admin-guide/kernel-parameters.txt.
232
.. [#amd-sbpb] IBPB without flushing of branch type predictions. Only exists for AMD.
234
.. [#amd-ibpb-rsb] "Function 8000_0008h -- Processor Capacity Parameters and Extended Feature Identification" in `AMD64 Architecture Programmer's Manual Volume 3: General-Purpose and System Instructions <https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/24594.pdf>`_. SBPB behaves the same way according to `this email <https://lore.kernel.org/5175b163a3736ca5fd01cedf406735636c99a>`_.
236
.. [#amd-ibpb-no-rsb] `Spectre Attacks: Exploiting Speculative Execution <https://comsec.ethz.ch/wp-content/files/ibpb_sp25.pdf>`_
238
.. [#intel-ibpb-rsb] "Introduction" in `Post-barrier Return Stack Buffer Predictions / CVE-2022-26373 / INTEL-SA-00706 <https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html>`_
240
.. [#amd-smep-rsb] "Existing Mitigations" in `Technical Guidance for Mitigating Branch Type Confusion <https://www.amd.com/content/dam/amd/en/documents/resources/technical-guidance-for-mitigating-branch-type-confusion.pdf>`_
242
.. [#intel-smep-rsb] "Enhanced IBRS" in `Indirect Branch Restricted Speculation <https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/indirect-branch-restricted-speculation.html>`_
244
.. [#amd-eibrs-vmexit] "Extended Feature Enable Register (EFER)" in `AMD64 Architecture Programmer's Manual Volume 2: System Programming <https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/24593.pdf>`_
246
.. [#intel-eibrs-vmexit] "Enhanced IBRS" in `Indirect Branch Restricted Speculation <https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/indirect-branch-restricted-speculation.html>`_
248
.. [#intel-pbrsb] `Post-barrier Return Stack Buffer Predictions / CVE-2022-26373 / INTEL-SA-00706 <https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html>`_
250
.. [#retbleed-paper] `RETBleed: Arbitrary Speculative Code Execution with Return Instruction <https://comsec.ethz.ch/wp-content/files/retbleed_sec22.pdf>`_
252
.. [#amd-btc] `Technical Guidance for Mitigating Branch Type Confusion <https://www.amd.com/content/dam/amd/en/documents/resources/technical-guidance-for-mitigating-branch-type-confusion.pdf>`_
254
.. [#amd-srso] `Technical Update Regarding Speculative Return Stack Overflow <https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf>`_
256
.. [#inception-paper] `Inception: Exposing New Attack Surfaces with Training in Transient Execution <https://comsec.ethz.ch/wp-content/files/inception_sec23.pdf>`_
258
.. [#intel-rsbu] `Return Stack Buffer Underflow / Return Stack Buffer Underflow / CVE-2022-29901, CVE-2022-28693 / INTEL-SA-00702 <https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/return-stack-buffer-underflow.html>`_
260
.. [#intel-ibpb-btb] `Indirect Branch Predictor Barrier' <https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/indirect-branch-predictor-barrier.html>`_
262
.. [#intel-eibrs-rrsba] "Guidance for RSBU" in `Return Stack Buffer Underflow / Return Stack Buffer Underflow / CVE-2022-29901, CVE-2022-28693 / INTEL-SA-00702 <https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/return-stack-buffer-underflow.html>`_
264
.. [#bhi-paper] `Branch History Injection: On the Effectiveness of Hardware Mitigations Against Cross-Privilege Spectre-v2 Attacks <http://download.vusec.net/papers/bhi-spectre-bhb_sec22.pdf>`_
266
.. [#intel-bhi] `Branch History Injection and Intra-mode Branch Target Injection / CVE-2022-0001, CVE-2022-0002 / INTEL-SA-00598 <https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html>`_
268
.. [#intel-retpoline-rrsba] "Retpoline" in `Branch History Injection and Intra-mode Branch Target Injection / CVE-2022-0001, CVE-2022-0002 / INTEL-SA-00598 <https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html>`_
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
RSB 관련 완화 개요
1-40이 문서는 계속 최신 상태로 유지해야 합니다. 그렇지 않으면 작성자가 갱신 작업을 맡고 내용을 `bugs.c`의 매우 긴 comment로 옮기게 될 수 있다는 경고로 시작합니다.
2018년 이후 Return Stack Buffer(RSB)와 관련된 Spectre CVE가 많이 등장했습니다. AMD 문서에서는 RSB를 Return Address Stack(RAS) 또는 Return Address Predictor(RAP)라고도 부릅니다.
CVE 정보와 완화 방법이 microarchitecture별 문서에 흩어져 있어, 이 문서는 현재 커널의 RSB 관련 attack vector와 실제 완화 및 그 근거를 한곳에 간결하게 정리합니다. RSB 자체의 동작이나 exploit 구현은 다루지 않으며 자세한 내용은 참고 자료를 따릅니다.
상위 수준에서 RSB 공격은 Intel·AMD의 RSB poisoning과 Intel 전용 RSB underflow 두 종류입니다. attack vector와 해당 microarchitecture마다 두 종류를 각각 검토해야 합니다.
RSB poisoning과 SpectreRSB
41-63SpectreRSB `[#spectre-rsb]_`는 공격자가 RSB entry를 오염시켜 피해자의 return instruction이 공격자 제어 address로 speculate하게 하는 RSB poisoning 기법입니다. context switch 또는 VMEXIT 뒤 CALL/RET 균형이 맞지 않을 때 발생할 수 있습니다.
신뢰하지 않는 domain과 신뢰하는 domain 사이를 전환할 때 RSB filling sequence `[#intel-rsb-filling]_` `[#amd-rsb-filling]_`로 오염 entry를 밀어내면 모든 attack vector를 잠재적으로 완화할 수 있습니다. 하지만 성능 영향이 있으므로 가능한 한 피해야 합니다.
현재 커널은 32개 entry를 flush하지만 일부 CPU model은 32개보다 많은 RSB entry를 가집니다. 해당 model에서는 loop count를 늘려야 하며 RSB size에 대한 더 자세한 정보가 필요하다는 FIXME가 남아 있습니다.
context switch의 user-to-user와 user-to-kernel 보호
64-108context switch의 user-to-user 완화는 conditional IBPB `[#cond-ibpb]_`가 쓰일 때 RSB도 채우거나 지워지도록 보장해야 합니다.
| architecture | IBPB와 RSB 동작 |
|---|---|
| AMD Zen 4+ | `IBPB` 또는 사용 시 `SBPB` `[#amd-sbpb]_`가 RSB를 지웁니다. CPUID의 `IBPB_RET`로 표시됩니다 `[#amd-ibpb-rsb]_`. |
| AMD Zen < 4 | IBPB에 더해 RSB filling sequence를 항상 수행해야 합니다 `[#amd-rsb-filling]_` `[#amd-ibpb-no-rsb]_`. `X86_BUG_IBPB_NO_RET`로 표시됩니다. |
| Intel | IBPB는 항상 RSB를 지웁니다. IBPB 이전 software가 이후 같은 logical processor의 indirect branch와 near return 예측 대상을 제어하지 못하게 합니다 `[#intel-ibpb-rsb]_`. |
context switch의 user-to-kernel 공격은 SMEP가 막습니다. userspace는 RSB에 userspace address만 넣을 수 있고, user canonical address space 끝의 `TASK_SIZE_MAX`용 page gap 때문에 non-canonical address도 넣을 수 없습니다. instruction fetch에서 SMEP `#PF`가 발생해 커널이 userspace를 speculative execution하지 못하게 합니다.
AMD는 RAP stuffing sequence(V2-3)와 SMEP 중 하나 이상을 사용해 RAP address를 speculation에 안전하게 만들 것을 권장하며 이를 RAP Protection이라고 부릅니다 `[#amd-smep-rsb]_`. Intel enhanced IBRS CPU에서는 RSB overwrite만으로 낮은 privilege predictor mode의 entry 사용을 막지 못할 수 있어 user-to-supervisor 전환에는 SMEP를 켜고 VM exit에는 `IA32_SPEC_CTRL.IBRS`를 설정해야 합니다 `[#intel-smep-rsb]_`.
VMEXIT의 guest-to-host 보호
109-134VMEXIT의 guest-to-host 공격은 eIBRS와 필요 시 PBRSB 완화가 막습니다.
AMD에서는 Automatic IBRS가 활성화되면 VMEXIT에서 return-address prediction용 internal return-address stack이 지워집니다 `[#amd-eibrs-vmexit]_`.
Intel enhanced IBRS에서는 VM exit 동안 `IA32_SPEC_CTRL.IBRS`를 설정하면, VM exit 시점에 IBRS가 설정되어 있지 않았더라도 이후 설정된 뒤 guest 동작이 RSB를 제어하지 못하게 합니다 `[#intel-eibrs-vmexit]_`.
일부 Intel CPU는 Post-barrier Return Stack Buffer Predictions(PBRSB) `[#intel-pbrsb]_`의 영향을 받습니다. guest의 마지막 `CALL`이 첫 번째 unbalanced `RET` 예측에 사용될 수 있으므로 이 경우 eIBRS에 더해 PBRSB 완화가 필요합니다.
AMD RETBleed·SRSO·Branch Type Confusion
135-145AMD에서는 AMD RETBleed 변형 `[#retbleed-paper]_` `[#amd-btc]_` 또는 Speculative Return Stack Overflow(SRSO, Inception) `[#amd-srso]_` `[#inception-paper]_`로도 오염된 RSB entry를 만들 수 있습니다.
커널은 모든 `RET`를 하나의 안전한 `RET`로 향하는 branch로 교체해 자신을 보호합니다.
Intel RSB Alternate(RSBA) underflow
146-190일부 Intel Skylake 세대 CPU는 Intel RETBleed 변형인 Return Stack Buffer Underflow(RSBA)의 영향을 받습니다 `[#retbleed-paper]_` `[#intel-rsbu]_`. CALL/RET 불일치나 깊은 call stack에서 돌아오느라 RSB가 비어 있을 때 `RET`를 실행하면 branch predictor가 Branch Target Buffer(BTB)로 fallback할 수 있습니다. 사용자가 BTB collision을 강제하면 `RET`가 사용자 제어 address로 speculative branch할 수 있습니다.
RSB filling만으로 이 문제를 완전히 막지는 못합니다. unbalanced `RET`가 충분히 많으면 RSB가 다시 underflow해 오염된 BTB entry를 사용할 수 있습니다.
context switch의 user-to-user underflow는 conditional IBPB가 BTB를 사실상 지워 완화합니다 `[#cond-ibpb]_` `[#intel-ibpb-btb]_`.
context switch와 VMEXIT의 user-to-kernel 및 guest-to-host RSB underflow는 IBRS 또는 eIBRS가 완화합니다. RRSBA를 열거하지만 `RRSBA_DIS_S`는 열거하지 않는 프로세서까지 enhanced IBRS 사용이 권장됩니다 `[#intel-rsbu]_`.
IBRS와 eIBRS는 intra-mode attack을 막지 못합니다. 이는 RRSBA와 마찬가지로 kernel entry에서 BHB를 지워 완화합니다. classic IBRS 대신 retpoline과 결합한 call-depth tracking으로 kernel return을 추적하고 RSB가 거의 빌 때 다시 채울 수도 있습니다.
Restricted RSB Alternate(RRSBA)
191-220일부 최신 Intel CPU의 Restricted RSB Alternate(RRSBA)는 RSBA처럼 RSB underflow 시 BTB로 fallback합니다. 차이는 eIBRS가 활성화되면 예측 대상이 현재 prediction domain의 indirect branch predictor entry로 제한된다는 점입니다 `[#intel-eibrs-rrsba]_`.
RRSBA CPU가 Branch History Injection(BHI)의 영향도 받으면 RSB underflow를 intra-mode BTI 공격에 사용할 수 있습니다 `[#bhi-paper]_` `[#intel-bhi]_`. kernel entry에서 BHB를 지워 완화합니다.
커널이 eIBRS 대신 retpoline을 사용하고 프로세서가 `RRSBA`와 `RRSBA_DIS` control을 모두 열거하면 RRSBA 동작을 비활성화해야 합니다 `[#intel-retpoline-rrsba]_`.
참고 자료
221-268| 표시 | 자료 |
|---|---|
| #spectre-rsb | Spectre Returns! - https://arxiv.org/pdf/1807.07940.pdf |
| #intel-rsb-filling | Intel Retpoline: Empty RSB Mitigation - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/retpoline-branch-target-injection-mitigation.html#inpage-nav-5-1 |
| #amd-rsb-filling | AMD Software Techniques for Managing Speculation - https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/software-techniques-for-managing-speculation.pdf |
| #cond-ibpb | `spectre_v2_user`의 per-task 또는 system-wide opt-in에 따라 context switch에서 IBPB write 여부가 결정됩니다. Documentation/admin-guide/kernel-parameters.txt를 참조하십시오. |
| #amd-sbpb | branch-type prediction을 flush하지 않는 AMD 전용 IBPB입니다. |
| #amd-ibpb-rsb | AMD64 Architecture Programmer's Manual Volume 3 - https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/24594.pdf ; SBPB 관련 mail - https://lore.kernel.org/5175b163a3736ca5fd01cedf406735636c99a |
| #amd-ibpb-no-rsb | Spectre Attacks - https://comsec.ethz.ch/wp-content/files/ibpb_sp25.pdf |
| #intel-ibpb-rsb | Intel PBRSB / CVE-2022-26373 - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html |
| #amd-smep-rsb | AMD Branch Type Confusion guidance - https://www.amd.com/content/dam/amd/en/documents/resources/technical-guidance-for-mitigating-branch-type-confusion.pdf |
| #intel-smep-rsb | Intel Indirect Branch Restricted Speculation - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/indirect-branch-restricted-speculation.html |
| #amd-eibrs-vmexit | AMD64 Architecture Programmer's Manual Volume 2 - https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/24593.pdf |
| #intel-eibrs-vmexit | Intel Enhanced IBRS - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/indirect-branch-restricted-speculation.html |
| #intel-pbrsb | Intel PBRSB advisory - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html |
| #retbleed-paper | RETBleed - https://comsec.ethz.ch/wp-content/files/retbleed_sec22.pdf |
| #amd-btc | AMD Branch Type Confusion - https://www.amd.com/content/dam/amd/en/documents/resources/technical-guidance-for-mitigating-branch-type-confusion.pdf |
| #amd-srso | AMD Speculative Return Stack Overflow - https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf |
| #inception-paper | Inception - https://comsec.ethz.ch/wp-content/files/inception_sec23.pdf |
| #intel-rsbu | Intel RSBU / CVE-2022-29901, CVE-2022-28693 - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/return-stack-buffer-underflow.html |
| #intel-ibpb-btb | Intel IBPB - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/indirect-branch-predictor-barrier.html |
| #intel-eibrs-rrsba | Intel RSBU guidance - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/return-stack-buffer-underflow.html |
| #bhi-paper | Branch History Injection - http://download.vusec.net/papers/bhi-spectre-bhb_sec22.pdf |
| #intel-bhi | Intel BHI / CVE-2022-0001, CVE-2022-0002 - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html |
| #intel-retpoline-rrsba | Intel BHI Retpoline guidance - https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html |
RSB poisoning
rsb.rst:1-145SpectreRSB, context switch·VMEXIT, AMD RETBleed와 SRSO의 방어 근거를 정리합니다.