A flaw was found in the implementation of Intel microprocessors Target Array sharing. A single physical branch prediction unit (hardware) within a single core is shared within two logical processor threads. An attacker with local authenticated access can cause the branch prediction unit to use an indirect target on both logical processors. A flaw in the CPU's indirect target matching would incorrectly match some targets as matching when they did not. This incorrect matching can be used as an attack vector for an attacker to carry out Spectre-V2 style attack on the impacted processor. A microcode update will be available that can disable TA sharing between logical processors to change the behaviour effectively mitigating this flaw.
Acknowledgements: Red Hat thanks Intel and industry partners for reporting this issue and collaborating on the mitigations for the same.
Statement: Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/solutions/2019-microcode-nov
External References: https://access.redhat.com/solutions/2019-microcode-nov
Mitigation: As of this time there are no known mitigations. Please install relevant updated packages to address this flaw.
Created microcode_ctl tracking bugs for this issue: Affects: fedora-all [bug 1771651]