Linux Kernel BPF Branch History Vulnerability Mitigation

A vulnerability in the Linux kernel's handling of BPF (Berkeley Packet Filter) programs has been addressed. This issue allowed a malicious BPF program to manipulate branch history, potentially influencing hardware speculation. The vulnerability was present in 'classic' cBPF programs loaded by seccomp. The mitigation involves adding a specific sequence to the epilogue of these BPF programs to counteract the manipulation of branch history.

Impact

Exploitation of this vulnerability could lead to unauthorized manipulation of branch prediction, allowing a BPF program to influence hardware speculation in a potentially harmful way.