BTR reads a Linux root password hash off an Intel core in minutes

Classic Spectre v2 tricks the processor into briefly running instructions at a jump destination it predicted wrongly, then reads the data those instructions touched out of the CPU cache ^[8]. BTR reaches that state through a JIT engine. On Linux the researchers used unprivileged classic BPF to train a branch prediction, freed the program, and dropped a different one into the same memory ^[10]. The stale target then sent the processor into attacker-crafted instructions at a misaligned offset, and the speculative memory access left a cache trace they read out one byte at a time ^[11].

The researchers, who reported the flaws to the affected vendors, completed the leak only through the Linux kernel's cBPF path ^[23]. In Firefox's SpiderMonkey the proof-of-concept showed stale predictions survive code reuse, but they did not build a full browser exploit ^[17]. In Oracle's GraalVM they found a way to speculatively skip a sandbox check, though the engine cleared the predictions before the attack could finish ^[18].

The behavior the attack turns on is not Intel's alone. "Indirect branch prediction is inherent to modern CPUs, and BTR exploits the desynchronization between the branch predictor and the actual state of the code," VUsec said ^[19]. "No current CPU has a mechanism to keep the two in sync, so until vendors add one, your CPU is vulnerable." ^[20] The group confirmed the same behavior "on every CPU we tested, covering Intel, AMD and Arm." ^[21] That covers the underlying behavior, not a finished exploit on AMD or Arm.