EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·12d ago·5 min read
Branch Target Reuse: Spectre-v2 Attacks in JIT Engines
TL;DR
Branch Target Reuse (BTR) is a new Spectre-v2 attack that exploits stale branch prediction entries in just-in-time (JIT) compilers, allowing attackers to hijack control flow and leak sensitive data. This attack affects various JIT engines, including those in web browsers and operating systems.
✦ Why It Matters
Review and enhance security measures in JIT engines to mitigate potential Spectre-v2 vulnerabilities.
Key Takeaways
- Investigate JIT engines for vulnerabilities related to branch prediction.
- Implement additional mitigations against Spectre-v2 attacks.
- Monitor CPU behavior regarding stale branch prediction entries.
- Educate teams on secure coding practices in JIT environments.
Full Summary
Branch Target Reuse (BTR) targets just-in-time (JIT) compilers by exploiting how modern CPUs handle indirect branch prediction entries. While CPUs restore code coherence after self-modification, they do not invalidate stale entries, which can be reused in JIT engines.
This leads to a speculative execute-after-free vulnerability, enabling attackers to redirect control flow to outdated code locations. The researchers analyzed JIT engines like Oracle GraalVM and SpiderMonkey, successfully building two end-to-end exploits against the Linux kernel.
Their exploits demonstrated the ability to leak arbitrary memory on modern Intel CPUs, bypassing all existing mitigations. The implications of this research highlight significant security risks in widely used software components.