The Branch Target Reuse (BTR) attack is a new Spectre v2 variant that exploits the CPU's branch predictor desynchronization with JIT-compiled code reuse. When a JIT engine frees code and places new code at the same memory address, the CPU may speculatively execute instructions based on stale indirect branch predictions. Researchers demonstrated that on Linux systems, this can be exploited using unprivileged classic BPF programs to leak the root password hash from memory at a rate of eight bytes per second, recovering the hash within 3 to 5 minutes on tested Intel CPUs. The attack was also evaluated against Firefox's SpiderMonkey and Oracle's GraalVM JIT engines, showing partial exposure. The vulnerability affects modern CPUs from Intel, AMD, and ARM, as no current CPU synchronizes branch predictor state with code changes. The researchers notified vendors, and fixes have been merged into the Linux kernel.

This vulnerability allows an attacker with unprivileged access to leak the root password hash from memory on Linux systems running on vulnerable CPUs. While the hash is not the plaintext password, it can be subjected to offline cracking attempts, potentially leading to privilege escalation if the password is weak. The attack is practical and can recover the hash within minutes. It affects a broad range of modern CPUs and Linux kernel versions prior to the merged fixes.

Fixes for this vulnerability have already been merged into the Linux kernel. Users are advised to update their Linux systems to the latest kernel versions containing these patches. Additionally, applying relevant OS and firmware updates is recommended. Since this is a hardware-related speculative execution issue, full mitigation requires both software patches and potentially future CPU design changes. No further immediate action is required beyond applying the official fixes.