Patching Will Affect Performance, As Is Tradition
If you had hoped the days of Spectre were behind you, then you haven’t watched enough Bond films. Researchers at ETH Zurich, a public research university in Switzerland have discovered an additional Spectre-BTI (variant 2) attack which they called Retbleed. It is able to replace indirect branch instructions with subroutine return instructions which allows it to completely avoid the retpoline mitigations which have helped with previous Spectre variants.
AMD’s Zen 1, Zen 1+ and Zen 2 are all vulnerable to this attack as are newer Intel Core generations 6 through 8, which includes EPYC and Xeon chips. The good news is that Retbleed is rather hard to exploit, even compared to other Spectre attacks and so the likelihood of encountering exploits in the wild are quite slim especially as it doesn’t affect Windows machines. That may not hold true for targeted attacks unfortunately, as there are those willing to put in the effort to get at a vulnerable AWS or Google Compute Engine instance.
As mentioned, once the patch for Retbleed is made available and installed, you should expect to see between a 13% to 39% negative impact on your processor’s performance. Take a peek at the full scope of the new vulnerability over at The Register.
