QID 354279

amazon linux has been made aware of a potential branch target injection (bti) issue (sometimes referred to as spectre variant 2).
This is a known cross-domain transient execution attack where a third party may seek to cause a disclosure gadget to be speculatively executed after an indirect branch prediction.
Generally, actors who attempt transient execution attacks do not have access to the data on the hosts they attempt to access (e.g. where privilege-level isolation is in place).
For such attacks to succeed, actors need to be able to run code on the (virtual) machine hosting the data in which they are interested. to mitigate this issue, amazon linux recommends that customers disable unprivileged ebpf.
this configuration, having the unprivileged ebpf disabled, is the current default for most linux distributions and as of this advisory, is also the default for all amazon linux kernels. specific mitigations for various cpus are listed below. intel cpus: for intel cpus, this applies to all instance types that have cpus with eibrs support.
They are: *6i* (all sizes), c5d.metal, c5.metal, g4dn.metal, i3en.metal, m5*.metal, r5*.metal vectors outside of unprivileged ebpf are not currently known, and intel recommends disabling unprivileged bpf, as mentioned above.
However, optionally enabling "spectre_v2=eibrs,lfence" on linux kernel command line on the instance types mentioned above, would provide additional protection. amd cpus: as part of the investigation triggered by this issue, amd now recommends using a different software mitigation inside the linux kernel, which the amazon linux kernel is enabling by default.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.