AMD issues fix for Spectre v2 which confirms nearly every desktop CPU is still vulnerable

Although AMD CPUs appear to be impervious to Spectre-BHB affecting CPUs from Intel and ARM, Intel’s IPAS STORM security team claims the patch that AMD has used to fix the Spectre v2 vulnerabilities has been broken since 2018. In other words, Intel is claiming that AMD’s mitigations for the security vulnerability were not just ineffective but were faulty as well.

AMD has issued a “Mitigation Update for CVE-2017-5715”, which basically means the company has released a new fix for the Spectre Variant 2 security vulnerability. The CPU maker offered the patch after Intel's security team, STORM, found the issue with AMD's previously issued mitigations.

AMD has essentially recommended using an alternative method to mitigate the Spectre vulnerabilities, and presumably, consider the previous mitigations as ineffective. Essentially, AMD has offered a new patch for an old security risk that the company had previously fixed, but as proven by Intel, didn't succeed.

Intel as well as ARM CPUs have been found to still be susceptible to Spectre v2-based attacks via a new Branch History Injection variant. This is concerning because Intel has used Enhanced Indirect Branch Restricted Speculation (eIBRS) and/or Retpoline mitigations. The majority of security researchers seemed to believe these fixes and mitigations were sufficient to address the risks Spectre v2 posed.

While attempting to develop alternative mitigation techniques, Intel discovered that the mitigations AMD has used since 2018 to patch the Spectre vulnerabilities aren't adequate. Specifically speaking, AMD has relied on "LFENCE/JMP" mitigation, but Intel has discovered that these mitigations aren’t enough to completely stop attacks using the Spectre v2 flaw.

The Spectre vulnerabilities can potentially allow attackers "unhindered and undetectable" access to information being processed in a CPU through a side-channel attack. It’s even more concerning to note that the flaw can be exploited remotely. AMD, however, has stressed that it hasn’t observed any active exploits in the wild of AMD products that rely on the flaw tagged as CVE-2017-5715.