Spectre Vulnerabilities in SiFive P550 and T-Head Xuantie C910/C920 RISC-V Processors
Research from CISPA and KU Leuven demonstrates that high-performance commercial RISC-V processors, specifically the SiFive P550 and T-Head Xuantie C910/C920, are susceptible to speculative execution side-channel attacks. By exploiting vulnerabilities in the Branch Predictor Unit (BPU) and Reorder Buffer (ROB), attackers can execute Spectre Variant 1 (Bounds Check Bypass), Variant 2 (Branch Target Injection), and Variant 4 (Speculative Store Bypass). These flaws allow unauthorized data extraction across security boundaries and privilege levels via cache timing analysis. While software mitigations like pipeline flushing and fencing are possible, they introduce significant performance overhead, highlighting a critical need for architectural hardware redesigns in the RISC-V ecosystem.
Interrupt Injection Attack Bypasses Spectre v2 Defenses on Intel and AMD CPUs
Researchers from MIT CSAIL have discovered "Interrupt Injection," a sophisticated Time-of-Check to Time-of-Use (TOCTOU) vulnerability that bypasses Spectre v2 mitigations on Intel and AMD CPUs. The attack exploits a critical timing window where an unprivileged user can trigger a hardware interrupt immediately after the branch predictor has been sanitized but before the kernel executes. This allows for the re-poisoning of the branch predictor, enabling speculative execution-based data leakage across privilege boundaries. The discovery exposes fundamental weaknesses in current microarchitectural defense implementations, necessitating immediate kernel-level updates to secure Linux-based systems against cross-privilege information disclosure.