New TONTOU Attack Exploits Spectre v2 Defenses on Intel and AMD CPUs

MIT researchers have unveiled a new speculative execution attack named TONTOU, which bypasses mitigations against Spectre v2 on Intel and AMD processors. The attack exploits a timing vulnerability in the post-neutralization window of branch predictors, allowing unprivileged code to re-poison these predictors and leak sensitive data, such as Linux password hashes. The researchers demonstrated the attack on AMD Zen 2 and Intel Cascade Lake Refresh processors. The method involves scheduling high-frequency timer interrupts to redirect control flow during critical execution phases. An AMD kernel fix is available, but many systems remain vulnerable until updates are applied. The attack highlights weaknesses in existing Spectre mitigations and poses a significant risk to Linux systems. The researchers will present their findings at DEF CON 34.

Key Points: • TONTOU attack bypasses Spectre v2 defenses on Intel and AMD CPUs. • The attack allows unprivileged code to leak sensitive data, including Linux password hashes. • An AMD kernel fix is available, but many systems are still at risk until updated.