AMD CPUs Are Potentially Vulnerable To Spectre / Variant 2

Last week in light of the Spectre disclosure. AMD believed they were at "near zero risk" to Variant Two / Branch Target Injection. But now the company confirmed last night that's not the case: they are at least potentially vulnerable.

AMD's updated statement by Mark Papermaster reads, "While we believe that AMD’s processor architectures make it difficult to exploit Variant 2, we continue to work closely with the industry on this threat. We have defined additional steps through a combination of processor microcode updates and OS patches that we will make available to AMD customers and partners to further mitigate the threat."

AMD will be rolling out new microcode updates for Ryzen/EPYC starting this week. For Linux users they also acknowledge the work being done on Retpoline for mitigating the threat.

The Retpoline Linux patches continue to be worked on but have yet to be mainlined. It's looking like Retpoline will likely land for Linux 4.16. There are also needed LLVM / GCC patches too, which have yet to land but hopefully will still make it for the upcoming GCC 8.0 release.

AMD's updated processor security statement can be read at AMD.com. AMD remains certain they are not vulnerable to the Meltdown vulnerability affecting Intel CPUs.