https://indirector.cpusec.org/index_files/Indirector_USENIX_Security_2024.pdf
This paper introduces novel high-precision Branch Target
Injection (BTI) attacks, leveraging the intricate structures of
the Indirect Branch Predictor (IBP) and the Branch Target
Buffer (BTB) in high-end Intel CPUs. It presents, for the
first time, a comprehensive picture of the IBP and the BTB
within the most recent Intel processors, revealing their size,
structure, and the precise functions governing index and tag
hashing. Additionally, this study reveals new details into the
inner workings of Intel’s hardware defenses, such as IBPB,
IBRS, and STIBP, including previously unknown holes in
their coverage.
This paper introduces novel high-precision Branch Target
Injection (BTI) attacks, leveraging the intricate structures of
the Indirect Branch Predictor (IBP) and the Branch Target
Buffer (BTB) in high-end Intel CPUs. It presents, for the
first time, a comprehensive picture of the IBP and the BTB
within the most recent Intel processors, revealing their size,
structure, and the precise functions governing index and tag
hashing. Additionally, this study reveals new details into the
inner workings of Intel’s hardware defenses, such as IBPB,
IBRS, and STIBP, including previously unknown holes in
their coverage.