● Covered by 2 sources · 2 reportsMedium impact1 negative1 neutral
New Interrupt Injection Attack Bypasses Spectre v2 Defenses on Intel and AMD CPUs
Key points
- New attack bypasses Spectre v2 mitigations on Intel and AMD CPUs.
- Exploits a timing window during branch predictor neutralization.
- Allows unprivileged local attackers to leak kernel memory.
- AMD released a Linux kernel patch on June 2.
- Intel states no mitigation is necessary for its CPUs.
New Attack Bypasses Spectre v2 Mitigations
Researchers have identified a new method, dubbed "Interrupt Injection" by MIT CSAIL researchers Daniël Trujillo and Mengjia Yan, and also referred to as TONTOU, that can bypass existing Spectre v2 mitigations on both Intel and AMD processors. This attack exploits a timing vulnerability in how CPUs sanitize or isolate branch predictors, which are neutralization-based mitigations.
How the Attack Works
The Interrupt Injection technique involves an unprivileged Linux program timing a hardware interrupt to occur in the gap between a processor sanitizing its branch predictor and the kernel utilizing it. This allows the attacker to re-poison the branch predictor after the defense has been executed. Spectre v2, also known as Branch Target Injection (BTI), manipulates the CPU's indirect branch predictor to cause speculative execution along an attacker-influenced code path, potentially exposing sensitive data.
Impact and Data Leakage
The attack requires no special privileges, only local code execution, making shared systems running affected processors vulnerable. On an AMD Zen 2 machine running Linux 6.14 with all default Spectre v2 mitigations enabled, the exploit successfully leaked arbitrary kernel memory at a rate of 5.47 bytes per second with 91.97% accuracy. This was sufficient to locate and read /etc/shadow, which stores system password hashes, in five out of ten attempts.
Vendor Response
The researchers disclosed their findings to AMD and Intel on February 5. AMD responded by planning a kernel patch, which has since shipped and is included in normal operating system updates. The fix, titled "x86/bugs: Make Safe-RET robust against interrupt injection," was committed to the Linux kernel on June 2 by AMD engineers Borislav Petkov and David Kaplan. Intel, however, stated that no mitigation is necessary for its CPUs.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Researchers discovered a new CPU attack, dubbed TONTOU, that bypasses existing Spectre v2 mitigations on AMD and Intel processors. This vulnerability allows an unprivileged attacker to leak sensitive data, such as Linux password hashes, by exploiting a timing window in branch predictor neutralization. The discovery highlights a persistent challenge in securing speculative execution against side-channel attacks.
Researchers discovered an "Interrupt Injection" attack that can bypass Spectre v2 mitigations on Intel and AMD CPUs by timing a hardware interrupt to re-poison the branch predictor. This vulnerability allows an unprivileged local attacker to leak kernel memory, with AMD releasing a patch for the Linux kernel and Intel stating no mitigation is necessary.