CVE-2022-0002

What it actually does

Non-transparent sharing of branch predictor within a context in some Intel processors allows an authorized local user to leak information across contexts via side-channel analysis.

Why it matters to the business

Attackers with local access on affected systems could extract sensitive data such as cryptographic keys or process memory contents, increasing risk on widely deployed hardware without immediate patches.

How an attack unfolds

An attacker with local user access runs unprivileged code that manipulates the shared branch predictor to infer data from other contexts on the same processor, potentially chaining with other local techniques for broader access.

How to fix it

Update affected Intel microcode and firmware; for listed packages apply the fix in commit 8e8a7ceba8ba57f6867947a16bfab319ca47c993 where applicable and verify processor mitigations are enabled.

How to confirm the fix worked

Confirm microcode updates are installed, review processor documentation for branch predictor mitigations, and test that local information disclosure tests no longer succeed on updated hardware.

Typical attack path

1. Obtain local user access on target system
2. Execute code to train and probe branch predictor
3. Measure timing or state to infer victim data
4. Extract secrets such as keys or memory contents

How to detect it

Search system logs for unusual local process activity involving performance monitoring or branch predictor interfaces; look for post-exploitation artifacts such as unexpected data exfiltration from processes handling sensitive information.

What your security team should do

• Prioritize microcode and firmware updates on all Intel systems
• Enable available hardware mitigations in BIOS and OS
• Monitor for local code execution attempts on high-value hosts
• Review EPSS trend and threat reports for any increase in exploitation activity