A new CPU attack technique, dubbed TONTOU (Time-of-Neutralization to Time-of-Use), has been discovered that can bypass existing Spectre v2 mitigations on both AMD and Intel processors. This method allows an unprivileged attacker to leak sensitive data from the kernel, including password hashes from the `/etc/shadow` file on Linux systems.
The Spectre v2 vulnerability, also known as Branch Target Injection (BTI), exploits a processor's indirect branch predictor to cause speculative execution along an attacker-influenced path. Modern processors employ branch prediction and speculative execution to enhance performance. Neutralization-based mitigations, such as Intel's eIBRS and AMD's Safe RET, aim to sanitize or isolate branch predictors to prevent such attacks.
However, researchers Daniël Trujillo, a PhD student, and Associate Professor Mengjia Yan, both from the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL), identified a critical time window between when the branch predictor is cleaned and when it is subsequently used by the victim branch. Existing mitigations incorrectly assume that attackers cannot exploit this gap.
The TONTOU attack introduces a primitive that enables re-poisoning of the CPU's state within this post-neutralization window. The researchers developed an "Interrupt Injection" technique, where unprivileged user programs schedule timer interrupts to occur during kernel execution. This forces the kernel to redirect to an interrupt handler, which is then used to poison microarchitectural states in the vulnerable window. This method can poison the processor's indirect branch predictor, affecting all types of indirect branches.
The attack was successfully demonstrated on an AMD Zen 2 system running Linux kernel version 6.14.0-37-generic. The researchers achieved arbitrary kernel memory leakage at a rate of 5.47 bytes/s with 91.97% accuracy. In five out of ten test runs, the attack successfully extracted the contents of `/etc/shadow`, each attempt taking approximately 18 minutes. While possible on Intel machines, the researchers noted that additional software requirements make the attack more complex on those platforms.
Successful exploitation requires overcoming several challenges, including precise alignment of interrupts with the post-neutralization window and using the interrupt handler to poison the correct branch predictor entry. The researchers addressed these through frequent interrupt injection, timer-triggered hardware interrupts, and both active and passive poisoning methods. They also noted that interrupt injection can lead to attacker-controlled poisoning of the Return Stack Buffer (RSB), causing speculative mispredictions of return targets. For RSB attacks, they combined interrupt injection with "Inception," a previously disclosed attack.
AMD has acknowledged the issue, stating in an advisory that the interrupt injection problem "appears to be associated" with the Linux implementation of the Safe RET mitigation against potential information disclosure attacks.
Trujillo and Yan presented their findings at the Black Hat USA security conference and are scheduled to share further details at USENIX Security 2026 between October 27 and 29.
