Johannes Wikner

**Name of the Vulnerable Software and Affected Versions** AMD CPUs (affected versions not specified) AMD Zen CPUs (affected versions not specified) AMD Zen1 to Zen4 CPUs (affected versions not specified) **Description** A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. The vulnerability, also known as Inception, is a novel transient execution attack that leaks arbitrary data on all AMD Zen CPUs in the presence of all previously deployed software- and hardware mitigations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD processors (affected versions not specified) **Description** The issue is related to aliases in the branch predictor of some AMD processors, which may cause them to predict the wrong branch type. This could potentially lead to information disclosure. The vulnerability is associated with incorrect branch type prediction, allowing an attacker to disclose protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel and AMD microprocessors (affected versions not specified) AMD microprocessor families 15h through 18h **Description** The issue is related to mis-trained branch predictions for return instructions, which may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. This can lead to the disclosure of protected information from kernel memory or enable an attack on the host system from virtual machines. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution. **Recommendations** For Intel and AMD microprocessors, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For AMD microprocessor families 15h through 18h, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessor generations 6 through 8 **Description** The issue is related to errors in processing the `ret` instruction, which retrieves an address for transition from the stack. This can allow an attacker to disclose protected information from kernel memory or launch an attack on the host system from virtual machines. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. **Recommendations** For Intel microprocessor generations 6 through 8, consider disabling the use of the `ret` instruction in sensitive code paths until a patch is available. Restrict access to kernel memory to minimize the risk of exploitation. As a temporary workaround, apply configuration changes to mitigate the risk of arbitrary speculative code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Processors (affected versions not specified) **Description** The issue is related to an unprotected alternative channel of return branch target prediction in some Intel(R) Processors, which may allow an authorized user to potentially enable information disclosure via local access. The RSBA behavior allows alternate branch predictors to be used by near RET instructions when the RSB is empty. When eIBRS is enabled, the predicted target of these alternate predictors are restricted to those belonging to the indirect branch predictor entries of the current prediction domain. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.