CVE-2022-26373: Infoleak

Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

On certain processors with eIBRS, an exception to the two above properties has been identified in some situations, shortly after an RSB-barrier: the linear address following the most recent near CALL2 instruction prior to a VM exit may be used as the RSB prediction for the first near RET instruction executed after VM exit that does not have a prior corresponding CALL instruction that was also

executed after VM exit. This document refers to a RET without a corresponding CALL after an RSB- barrier as an unbalanced RET.

Operating system (OS) and virtual machine manager (VMM) software that could potentially execute an unbalanced RET can use a short software sequence to mitigate this issue. Note that software which does not execute potentially affected RET instructions (such as when “RSB stuffing” is used) is not affected. The target that may be used across an RSB-barrier is limited to the most-recent CALL prior to the

barrier. A cross-barrier RSB target will not be used for RET predictions that are made after the first post- barrier CALL retires.

Refer: https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/post-barrier-return-stack-buffer-predictions.html

— Red Hat