The AMD Branch (Mis)predictor Part 2: Where No CPU has Gone Before (CVE-2021-26341)

Tue, 08 Mar 2022 00:00:00 -0500

In this blog post, OSS Security Researcher Pawel Wieczorkiewicz shares his journey from trying to save one byte of code to the discovery of two new cases of Straight-Line-Speculation (SLS) which affect the Zen1 and Zen2 microarchitectures of AMD CPUs. Using the findings presented in his earlier blog on the AMD branch predictor, he demonstrates a proof-of-concept exploit for eBPF against the current Linux kernel adaptable for defeating KASLR.