CVE-2021-33624

Proof of Concept for CVE-2021-33624 compile with gcc -pthread -o bpfspectretypeconfusion bpfspectretypeconfusion.c -Wall -ggdb -std=gnu99 execute with sudo ./bpfspectretypeconfusion 1 2 ffffffffa4925620 0x10 where 1 and 2 are CPU threads which run on two distinct hardware cores, ffffffffa4925620 ...

CVE-2023-0045

Bypassing Spectre-BTI User Space Mitigations on Linux This is a working document, please send us feedback if you think we got something wrong or if we missed a citation Version 1.0 José Oliveira esoj Rodrigo Branco BSDaemon Introduction When testing the success rate of Spectre-BTI attacks, we...

Jump-over-ASLR-BTB

Branch Predictors & ASLR Author: Byte Reaper Description This repository contains research C implementation that demonstrates concepts related to branch predictors, speculative execution, and cache-based side channels in the context of address space layout randomization ASLR. Requirements : Linux...

spectre-attack-example

Spectre Attack Example January 2, 2018 CVE-2017-5753 and CVE-2017-5715 "Spectre" exploit example What is this? We place the text "The Magic Words are Squeamish Ossifrage." in memory, and then we attempt to read it using the vulnerability. If the system is vulnerable, you will see the same text on...

Astra Linux – Vulnerability in Linux 5.15, Linux

Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type, potentially leading to information disclosure...

PT-2026-98704

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the is branch taken function fails to distinguish between BPF JMP and BPF JMP32 comparisons. This leads to incorrect...

Astra Linux – Vulnerability in Linux, Linux 5.10

The non-transparent sharing of the branch predictor within the context of some Intel processors may allow an authorized user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in Linux, Linux 5.10

The non-transparent sharing of branch predictor selectors between contexts in some Intel processors may allow an authorized user to potentially enable information disclosure through local access...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ibprctlset function updates the Thread Information Flags TIFs for the task and updates the SPECCTRL MSR in the function speculationctrlupdate, but the IBPB is only issued at the next schedul...

ROS-20260904-73-0001

The vulnerabilities of the Branch Target Buffer BTB and Indirect Branch Predictor IBP in Intel microprogramming devices stem from the state of the race within the pipeline. Exploiting these vulnerabilities can allow attackers to disclose protected information by executing specially crafted...

TONTOU: On the Exploitability of Time-of-Neutralization to Time-of-Use Windows

Recently deployed Spectre v2 mitigations neutralize branch predictor state when switching privilege contexts or immediately prior to indirect branch execution, either through domain isolation or sanitization. These defenses assume that subsequent branch predictor behavior remains free from attack...

CVE-2026-64507

A flaw was found in the Linux kernel. This vulnerability involves an incomplete defense against Spectre-v2, a type of attack that can expose sensitive information by exploiting how modern processors predict future operations. Specifically, when the Berkeley Packet Filter BPF Just-In-Time JIT...

PT-2026-68922

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A security vulnerability exists in QEMU, the details of which have not been fully disclosed.CVE-2026-15578 CVE-2026-15705 is an undisclosed vulnerability in QEMU. The vulnerability has be...

PT-2026-68920

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A security vulnerability exists in QEMU, the details of which have not been fully disclosed.CVE-2026-15578 CVE-2026-15705 is an undisclosed vulnerability in QEMU. The vulnerability has be...

PT-2026-68923

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A security vulnerability exists in QEMU, the details of which have not been fully disclosed.CVE-2026-15578 CVE-2026-15705 is an undisclosed vulnerability in QEMU. The vulnerability has be...

SUSE CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

AZL-93857 CVE-2026-64508 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

UBUNTU-CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508

CVE-2026-64508 relates to a Linux kernel vulnerability in BPF JIT memory reuse. The issue arises when the BPF JIT allocator reuses space for new programs, potentially letting indirect jumps reuse stale branch predictions. Fix implemented: flush indirect branch predictors on JIT memory reuse via a...