Researchers Johannes Wikner and Kaveh Razavi from ETH Zurich disclosed novel speculative execution attacks dubbed “Post-Barrier Spectre,” demonstrating that the Indirect Branch Predictor Barrier (IBPB) fails to isolate branch predictions across security domains on modern x86 hardware. On 12th through 14th Gen Intel Core and 5th/6th Gen Xeon processors, a microcode flaw prevents IBPB from flushing Return Address Stack (RAS) predictors across context switches. Unprivileged local attackers can mistrain the return branch predictor to survive the barrier and leak root password hashes from privileged SUID binaries like sudo via cache side-channels.

On AMD Zen 1, Zen 1+, and Zen 2 systems running Linux, researchers discovered an architectural gap in the kernel’s IBPB-on-entry logic that omitted software return-stack sanitization, leaving privileged kernel memory exposed to cross-privilege speculative reads. Although in-the-wild exploitation remains unobserved, researchers demonstrated reliable proof-of-concept exfiltration defeating both eIBRS and Safe-RET mitigations. Intel issued updated processor microcode to enforce complete RAS invalidation, while Linux kernel maintainers patched the IBPB dispatch sequences and return-stack flushing routines.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Microarchitectural barrier primitives form the foundational hardware isolation boundary between untrusted userland and privileged processes. Incomplete state invalidation across context switches defeats hardware-enforced isolation, turning standard return instructions into speculative side-channel exfiltration gadgets.
• Bullet 2 — Strategic & Defender Imperative: Infrastructure operators and cloud hosting providers must prioritize applying updated CPU microcode from Intel/AMD alongside the latest Linux kernel packages, while auditing multi-tenant environments where unprivileged local code execution could compromise host-level secrets.