Retbleed on Linux: Kernel 5.19-RC7 Closes CPU Vulnerabilities

Initiator and lead developer Linus Torvalds has the next release candidate for the upcoming system kernel Linux 5.19 with a fix for the Retbleed vulnerabilities, the vulnerabilities discovered in 2017 in CPUs from AMD and Intel, which are still widespread Specter and Specter V2 can exploit, now released.

RC7 is not the last release candidate

Linux 5.19-RC7 will be followed by Linux 5.19-RC8, Torvalds announced. In announcing the official release of the free Linux 5.19-RC7 operating system kernel, Linus Torvalds made it clear that Linux 5.19 will not be released after the 7th release candidate like most kernels before it.

That said, last week there were two other development trees that independently also requested an extension, so 5.19 will be one of those releases that will have an additional rc8 next weekend before the final release. Linus Torvalds

RC8 due to Retbleed and Intel’s firmware

One of the reasons for the unplanned additional release candidate is the latest processor vulnerability Retbleed, which is found in CPUs based on AMD’s Zen 1, Zen 1+, and Zen 2, as well as Intel’s 6th to 8th core generations with the smart return command setting, can be exploited. become. Retbleed vulnerabilities

• AMD: CVE-2022-29900
• information: CVE-2022-29901

Linux 5.19-RC7 and the upcoming 8th release candidate are already protected from rebleed, but in addition to this extra work, there was also an issue with Intel’s firmware for the Alder Lake hybrid CPUs and a revoked patch for the file system btrfs added, as Torvalds unhappily testifies.

We had last minute btrfs refunds and there is also an Intel GPU firmware issue. When it rains, pour it. Linus Torvalds

Linux 5.19 will be released on July 31

After Linux 5.19-RC8, the next and this time final release candidate is expected next week, the final release of Linux 5.19 is scheduled for July 31 – Linus Torvalds is also ultimately forgiving.

Not that it really looks that bad. I think we’ve all dealt with the rebleed fallout (knock wood), and the btrfs reverts are in place. And the Intel GPU firmware issue also seems to have a patch pending (or we’ll just return). So it’s not that we have major problems, but an extra week is definitely needed. Linus Torvalds

The official website provides more information on the topic of “Retbleed”. Papers (PDF) the Swiss security researcher of the ETH Zurich.