RISC-V也躲不过Spectre？实测SiFive/玄铁读Linux内核内存：漏洞细节太扎心

Big headline from USENIX Security 2026: CISPA (Germany) and KU Leuven tested multiple *commercial* RISC-V CPUs in real attack scenarios—and found Spectre-style speculative execution leaks work just as badly as on modern x86 and Arm. They evaluated processors including SiFive P550 and T-Head XuanTie C910/C920. The key idea: Spectre’s “speculate first, then squash” behavior can still leave inferable traces in microarchitectural state (like caches), even when the branch prediction guess is wrong. Across 13 tested attack setups, 12 succeeded on those chips. Coverage includes conditional branches, indirect jumps, return prediction, and classic Spectre techniques that infer secrets via dependent memory read/write patterns. This isn’t magic—an attacker still needs code execution on the target. In a C910 demo, researchers used Linux’s BPF (Berkeley Packet Filter) to show a path to arbitrary core memory reads, measuring a median leak rate of ~338 bytes/sec. But exploit reliability depends on specific Linux versions/configs, and some variants require certain branch-prediction features. Worse: software mitigations may fail due to RISC-V compilation quirks (e.g., barrier_nospec() turning into a no-op) and BPF JIT behavior. #RISCv #Spectre #USENIX #LinuxSecurity #SpeculativeExecution #Microarchitecture

Want to learn more? Visit Explore the world, stay updated on travel insights and international affairs, and discover authentic stories from real life