New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses
-
Researchers from VUSec and Scuola Superiore Sant'Anna have disclosed a new Spectre-v2 variant that has been codenamed Branch Target Reuse (BTR). The vulnerability affects Just-In-Time (JIT) engines found in web browsers, language runtimes, and the operating system kernel, and it spans multiple CPU vendors.
According to the researchers, the core insight behind the attack is that although modern CPUs are equipped with mitigations, those defenses can still be bypassed to leak Linux memory. The disclosure notes that existing protections are not sufficient to stop this class of attack.
The technical details remain limited in the excerpt, but the affected surface is broad:
- Web browser JIT engines
- Language runtime JIT engines
- Operating system kernel JIT components
- Systems running on multiple CPU vendors
Because the issue targets shared speculative execution behavior rather than a single product, users should watch for vendor advisories covering CPU microcode, kernel updates, and browser/runtime patches. No specific CVE ID or KB number was provided in the source material, so keep an eye on official channels for those identifiers as they are assigned.
Source: The Hacker News
Has your organization begun reviewing its JIT and speculative execution exposure in light of this disclosure?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login