New Spectre-v2 BTR attack leaks Linux memory despite existing defenses

Researchers from VUSec and Scuola Superiore Sant’Anna disclosed a new Spectre-v2 variant, Branch Target Reuse (BTR), affecting JIT engines in web browsers, language runtimes, and the operating-system kernel. BTR was evaluated against SpiderMonkey, GraalVM, and the Linux kernel’s cBPF JIT, and all were found to be affected. Linux kernel proof-of-concept exploits leaked and recovered the root password hash within minutes from a fully patched Intel system with default protections enabled.