{"id":124683,"date":"2025-05-13T15:05:07","date_gmt":"2025-05-13T13:05:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/training-solo-novye-varianty-ataki-spectre-v2-zatragivayushhie-cpu-intel"},"modified":"2026-01-24T17:56:45","modified_gmt":"2026-01-24T15:56:45","slug":"training-solo-novye-varianty-ataki-spectre-v2-zatragivayushhie-cpu-intel","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/training-solo-novye-varianty-ataki-spectre-v2-zatragivayushhie-cpu-intel","title":{"rendered":"Training Solo \u2014 new attack vectors of Spectre-v2 affecting Intel CPUs.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A group of researchers from the Free University of Amsterdam has identified several new vulnerabilities of the Spectre-v2 class, published under the codename Training Solo, which allow bypassing memory isolation mechanisms. In the context of virtualization systems, these vulnerabilities enable the extraction of the host environment's memory content from guest systems, and in the context of servers, they allow for accessing kernel memory when an exploit is executed in user space. Examples of exploits for carrying out such attacks are published on GitHub. The presented exploits allow arbitrary data to be extracted from kernel memory at a rate of 17 KB\/sec, and from the hypervisor memory at 8.5 KB\/sec. <\/p>\n
In Spectre-v2 attacks, data leakage is organized by manipulating values in the Branch Target Buffer or the Branch History Buffer, which are used for predicting the next branching operation. Through manipulations of the history buffer, conditions for incorrect branch predictions during speculative instruction execution are created. The attacker's goal is to ensure that the address for the branch is taken from the desired memory area during speculative operation execution. After executing the speculative branch, the processor cache retains the read address from memory (this address appears as data needed by the attacker from memory). One method for extracting information from the cache involves determining cache contents based on analyzing the change in access time to cached and non-cached data. <\/p>\n
The Training Solo attack methods target the bypassing of domain isolation mechanisms, such as IBPB, eIBRS, and BHI_NO, used to block Spectre-v2 class attacks. For instance, the IBPB (Indirect Branch Prediction Barriers) instruction ensures the state of the branch prediction block is reset with each context switch \u2014 when control is transferred between user space and the kernel or between the guest system and the host environment. Resetting the state blocks the possibility of using custom code to influence the behavior of the indirect branch prediction block. <\/p>\n
The difference in Training Solo methods is that they propose not running attacker-controlled code to influence the prediction block but rather using code already present in the privileged execution area (the kernel or hypervisor), from which the attacker achieves leaks. Otherwise, the methods resemble classical Spectre-v2 attacks. Additionally, researchers identified two hardware issues (CVE-2024-28956 and CVE-2025-24495) that allow complete bypassing of execution area isolation and facilitate leaks from processes of other users, other guest systems, or the host environment.
<\/center> <\/p>\n
Three types of Training Solo attacks are proposed: <\/p>\n
\n
Distortion of the branch prediction logic by invoking existing command sequences (gadgets) in the kernel that affect the buffer containing the history of branches. Such gadgets include the access control mechanism for system calls SECCOMP, which allows for false indirect branches in speculative mode through the substitution of custom BPF filters (filters in SECCOMP are set using classical cBPF, which is enabled by default, unlike eBPF). Testing on Intel Tiger Lake and Lion Cove CPU showed a leak speed of 1.7KB\/sec when using this method.\n
Using Instruction Pointer (IP) collisions in the branch prediction block. An attacker can create conditions under which the address for speculative branching is chosen solely based on an already existing address in the buffer, ignoring the history of branches. The idea is that one indirect branch operation can influence another if there is a collision when storing hashes of their addresses in the BTB (Branch Target Buffer).\n
Exploiting the influence of direct jumps on indirect branch prediction. This behavior is caused by two hardware vulnerabilities: CVE-2024-28956 \u2014 ITS (Indirect Target Selection) and CVE-2025-24495 \u2014 an issue in Intel CPUs with Lion Cove cores. The data leakage rate from memory using this method reached 17 KB\/sec. In the demonstrated exploit for determining the hash of the root user's password, stored in memory after the 'passwd -s' command was issued, it took 60 seconds. <\/ul>\n
![\"Training](\"\/wp-content\/uploads\/2025\/05\/aab3af31923044fc239d55ff8b7846b4.png\")
<\/center> <\/p>\n![\"Training](\"\/wp-content\/uploads\/2025\/05\/14076832d38911938e435cf800505ac7.png\")
<\/center> <\/p>\n