Researchers at MIT CSAIL have reportedly discovered a novel interrupt injection attack, dubbed "INTERRUPT INJECTION," capable of bypassing existing Spectre v2 defenses on both Intel and AMD CPUs. The technique allows an unprivileged Linux program to exploit a timing window, effectively re-poisoning a processor's branch predictor after the system's mitigations have already executed.
The core mechanism of INTERRUPT INJECTION relies on precise timing of hardware interrupts. According to the report, an unprivileged program can schedule an interrupt to occur in the brief interval between a processor's branch predictor being sanitized by existing Spectre v2 defenses and the kernel subsequently utilizing that predictor. This allows the attacker to inject malicious entries into the branch predictor after the defensive measures have completed their operation, thereby circumventing the intended protection.
This class of attack targets speculative execution vulnerabilities, specifically those related to branch prediction, which are fundamental to modern CPU architectures. Spectre v2 mitigations typically involve flushing or sanitizing the branch predictor state to prevent information leakage across security boundaries. By timing an interrupt to land in this specific window, INTERRUPT INJECTION exploits a subtle race condition in the defense mechanism itself, rather than a flaw in the underlying speculative execution logic directly.
The researchers, Daniël Trujillo and Mengjia Yan, demonstrated the technique on an AMD Zen 2 machine running Linux 6.14. The report explicitly states that the system had all default Spectre v2 mitigations enabled, indicating that the attack is effective even when standard protections are in place. While the specific impact on Intel CPUs was not detailed in the summary, the headline suggests the attack is applicable to both major x86 architectures.
Mitigation for such timing-based attacks often involves either hardening the timing windows themselves, making them less predictable or exploitable, or introducing more robust isolation mechanisms that are not susceptible to branch predictor manipulation. For end-users and system administrators, ensuring operating systems and firmware are kept up-to-date with the latest security patches is always critical, as vendors typically release microcode or kernel updates to address newly discovered speculative execution vulnerabilities.
The discovery of INTERRUPT INJECTION underscores the ongoing challenge of securing modern CPUs against sophisticated side-channel attacks. Despite significant efforts to mitigate speculative execution vulnerabilities like Spectre v2, new techniques continue to emerge that exploit subtle interactions between hardware, software, and timing. This highlights the need for continuous research and development into both hardware-level security features and software-based defenses to maintain the integrity and confidentiality of data in contemporary computing environments.
