Wind River Support Network

Summary

Researchers disclosed two new cache speculation vulnerability known as Branch History Injection (BHI) and Intra-mode BTI (IMBTI). A serials of Intel cpus are affected on it.

---

Affected Product Versions

Wind River Linux 8, Wind River Linux LTS 21, Wind River Linux CD, Wind River Linux LTS 19, Wind River Linux LTS 18, Wind River Linux LTS 17, Wind River Linux 9, Wind River Linux 5, Wind River Linux 6, Wind River Linux 7

---

Description

CVE-2022-0001(Medium): Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

CVE-2022-0002(Medium): Non-transparent sharing of branch predictor within a context in some Intel® Processors may allow an authorized user to potentially enable information disclosure via local access.

What software is known to be affected by these CVEs?

This is a security issue in CPU, mitigated by linux kernel(and microcode) update.

Is Wind River Linux affected by these CVE issues?

YES. This is a issue of CPU, if your CPU is affected, yes, the Windriver Linux system running on it is affected.

Affected software components:

Mitigation

Different CPU need different mitigation method. All affected CPUs need kernel patch, seldom of them also need to upgrade microcode. For details please also see the affected processors table above.

With newest microcode and linux kernel, you need to disable unprivileged eBPF in runtime:

 $ sudo sysctl kernel.unprivileged_bpf_disabled=1

---