Researchers from MIT CSAIL have discovered a new Spectre v2 attack technique called TONTOU that bypasses current mitigations on AMD and Intel processors by exploiting a timing window between branch predictor neutralization and use. The attack leverages timer interrupts to re-poison the CPU's indirect branch predictor after it has been cleaned but before it is used, enabling extraction of sensitive kernel data from unprivileged code. The researchers demonstrated the attack on an AMD Zen 2 system running the latest Linux kernel, successfully leaking the contents of /etc/shadow containing password hashes at 5.47 bytes per second with 91.97% accuracy, completing each attempt in approximately 18 minutes.
The technique combines interrupt injection with passive and active poisoning methods to redirect kernel control flow, precisely align interrupts with the post-neutralization window, and manipulate branch predictor entries. The attack overcomes challenges including installing timers for hardware interrupts and employing both active and passive poisoning strategies. Intel systems are also vulnerable though additional software requirements make exploitation more complex. The researchers presented their findings at Black Hat USA and will also present at USENIX Security 2026. The attack demonstrates that current neutralization-based mitigations are insufficient, as the gap between cleaning and using branch predictor state can be weaponized. AMD published an advisory noting the issue appears associated with Linux's implementation of Safe RET mitigation against information disclosure attacks.
Read more...