Critical Intel CPU Flaw Bypasses Spectre-BTI Mitigations: Branch Privilege Injection (CVE-2024-45332)

Researchers have discovered a critical vulnerability in Intel CPUs, dubbed Branch Privilege Injection (CVE-2024-45332), that bypasses hardware mitigations against Spectre-BTI attacks implemented over the past six years. Exploiting asynchronous branch predictor updates and insufficient synchronization during privilege switches, the flaw allows attackers to leak arbitrary memory at 5.6KiB/s. Intel has released a microcode update to address this, but it incurs a performance overhead of up to 2.7%. The vulnerability affects all Intel processors since the 9th generation (Coffee Lake Refresh).