AMD Zen 1-Zen 5 - branch predictor isolation between guest and userspace hypervisor (AMD-SB-7046): Insufficient

Impact

Insufficient branch-predictor isolation between a guest VM and the **userspace** hypervisor process - QEMU - lets a malicious guest train the predictor and then steer speculation inside the VMM that manages it. The VMM has the guest's memory mapped, so this is a Spectre-class read of confidential guest state from a process the guest can influence. AMD rates it High and, unusually, it spans **Zen 1 through Zen 5** - there is no 'we are on new silicon' escape from this one.

Who can reach it

From inside a guest VM. Tenant-reachable, no host privilege required. Affects every AMD generation currently in datacenter service.

What to do

Fixed in the Linux kernel by issuing a conditional IBPB after every VMexit before returning to userspace. Take the distro kernel update and reboot the host - no firmware, BIOS or microcode step, which makes it one of the cheaper fixes to deploy. **Expect a real performance cost**: the kernel commit itself notes the IBPB duplicates the context-switch IBPB and that workloads switching frequently between hypervisor and userspace absorb the most overhead. On a virtualised GPU fleet with heavy device emulation, benchmark before and after rather than assuming it is free.

References