Branch Target Reuse (BTR) is a new Spectre v2 variant disclosed by researchers from VUSec and Scuola Superiore Sant’Anna that affects Intel, AMD, and Arm CPUs. BTR exploits the persistence of stale indirect branch prediction entries after code self-modification, particularly in JIT compilers used by OS kernels, browsers, and runtimes. This results in a speculative execute-after-free primitive allowing attackers to hijack speculative execution and leak sensitive memory data. The researchers developed exploits against Linux cBPF and Firefox’s SpiderMonkey engine, demonstrating leakage of root password hashes and potential browser-based attacks. Mitigations rely on software mechanisms like IBPB, with Linux kernel developers and Oracle implementing partial fixes. Hardware protections such as Intel’s IBT and Arm’s BTI make exploitation harder but do not fully prevent it. The issue stems from CPUs lacking mechanisms to synchronize branch predictors with code changes. AMD states existing Spectre v2 mitigations cover this technique, while Intel and Arm have not publicly commented.

The BTR attack enables an attacker with code execution on a target machine to leak sensitive data from memory, including password hashes. It can bypass existing mitigations on modern Intel CPUs and affects multiple CPU vendors (Intel, AMD, Arm). The attack surface includes OS kernels, web browsers, and language runtimes that use JIT compilation. Browser-based exploitation is feasible but not yet fully demonstrated. The attack can leak data at rates sufficient to extract secrets over time. Hardware mitigations reduce but do not eliminate the risk, and software mitigations are required to mitigate the threat.

Mitigations require software updates implementing indirect branch prediction barriers (IBPB) and related controls. Linux kernel developers have introduced an x86 mitigation triggering IBPB when reusing memory regions for BPF code. Oracle has deployed partial mitigations, and Mozilla is prioritizing site isolation to reduce browser exposure. Existing hardware protections (Intel IBT, Arm BTI) increase difficulty but do not fully prevent exploitation. Users and administrators should apply all available OS and runtime updates addressing this issue. Patch status is not yet fully confirmed; check vendor advisories for current guidance.