As far as I understand, one of the two attacks does affect AMD, and it's hard to solve as it relies on normal branch prediction.

Well there is spectre, and meltdown. Spectre is much more limited than meltdown. The patch AMD was referring to was for Meltdown.

Spectre at least does not leak ring-0 memory. Sure it means that some application might be able to read/infer memory values of other user-mode process.

Spectre is much scarier than Meltdown, from my understanding, because it represents a whole class of strategies that lack a single fix, even at the hardware level.

My understanding is that it's not a bug of unintended behaviour, but rather a problem with the specification, all behaviour is as intended, but we need to have different behaviour. Which means that basically we need to get a new ISA -- or a new version of an existing one -- and transition everything to it.

Amd claims that two of the three spectre attacks don't work on their hardware and the last one (variant one) is fixable with negligible performance impact.

https://www.amd.com/en/corporate/speculative-execution

I still don‘t get how variant 1 is fixable with negligible impact. Do we have any details on this as of now?

A bit of PR spin in Variant 2:

Differences in AMD architecture mean there is a near zero risk of exploitation of this variant. Vulnerability to Variant 2 has not been demonstrated on AMD processors to date.

Near-zero is not zero.

That's fantastic. I know whom my next CPU will be made by.