"It's definitely not a simple attack, but we show that it's practical with our end-to-end exploit on AMD Zen 2," said Daniël Trujillo, previewing research he and Mengjia Yan will present at DEF CON 34.
TONTOU: re-poisoning the branch predictor between neutralization and use
Trujillo and Yan of MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) describe a new speculative-execution technique they call TONTOU — Time-of-Neutralization to Time-of-Use. The attack targets a foundational assumption in current Spectre-style mitigations: that branch predictor state, once neutralized, cannot be altered before a protected branch executes. Vendors and operating systems neutralize potentially hostile predictor state either when privileged code is entered ("entry neutralization") or immediately before a protected branch executes ("in-place neutralization"). Intel's eIBRS implements entry neutralization and AMD's Safe RET implements the in-place approach. TONTOU shows an attacker can re-poison predictor structures during the short "post-neutralization window" between sanitization and the victim branch's use, subverting those defenses.
Interrupt injection: the primitive that times the window
The researchers built an attack primitive they call "interrupt injection." An unprivileged user-space program schedules high-frequency timer interrupts hoping one will land inside the post-neutralization window. If an interrupt handler runs after the neutralization phase and before the victim branch executes, the handler can retrain predictor structures such as the return stack buffer (RSB) or the branch history buffer (BHB). By doing so, the attack can steer speculative execution to a disclosure gadget that leaks kernel memory through a side channel.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogPractical tests on Intel and AMD Linux systems
The team tested TONTOU on Intel Cascade Lake Refresh and Arrow Lake processors and on AMD Zen 2 and Zen 4 chips, and reported the technique works on both Intel- and AMD-based Linux systems. They built a complete end-to-end exploit only for Zen 2 — partly because the Intel variant requires particular software conditions. Each end-to-end attempt took about 18 minutes, and Trujillo posted a sped–up video demonstration to YouTube. In experiments aimed at breaking Linux kernel address space layout randomization (KASLR), the researchers located kernel layout on every one of ten runs and successfully located and leaked the contents of /etc/shadow in five of those runs.
Constraints, caveats, and the threat model
- The researchers emphasize TONTOU is not trivial to execute: speculative side-channel attacks remain difficult and noisy, and the team cautioned that other attack types such as ransomware present more common real-world risks.
- The Zen 2 end-to-end exploit used a stock Linux kernel version with no inserted modules and all default mitigations enabled, according to Trujillo. That leads the authors to flag environments where unprivileged code runs with timer availability while sharing the kernel with a victim — multi-tenant container platforms are explicitly called out as at risk.
- The attack depends on the availability of suitable disclosure gadgets and precise timing to hit the post-neutralization window, which helps explain why the researchers could complete full exploits only under specific conditions.
How AMD, Intel and Arm have responded
After finishing their experiments the researchers engaged Intel, Arm and AMD. AMD committed to address the issue via kernel patches. Intel told the team it would not be developing additional mitigations, saying real-world exploits depend on many factors such as the availability of disclosure gadgets; Intel did award a bug-bounty payment in the hundreds of dollars. Arm classified TONTOU's interrupt injections as "passive leakage," which it does not "actively protect against." The researchers said they hope their work will prompt further study of interrupt injections and help spur more robust mitigations against Spectre-style exploits.
What this means for multi-tenant container platforms, kernel maintainers, and security teams
Multi-tenant container platforms: the researchers explicitly warned that ordinary user-space programs with timer access running on systems that share the kernel with other tenants could be used to leak kernel memory via TONTOU-style attacks.
Kernel maintainers and OS security teams: with AMD committing kernel patches, maintainers will need to assess and deploy those fixes; the research puts pressure on maintainers to consider interrupt-timing as an attack vector against neutralization mechanisms.
Security teams and system administrators: the attack underlines that default mitigations and stock kernels are not a guarantee against novel speculative-execution primitives — teams should monitor vendor advisories (AMD has committed patches) and be aware of the class of attacks that exploit the post-neutralization window.
Trujillo and Yan's paper will be presented at DEF CON 34; they say their goal is to prompt additional research into interrupt injection and to aid development of more robust countermeasures. The proof-of-concept work demonstrates that established assumptions about the safety of short windows between sanitization and use deserve fresh scrutiny.
Original story: MIT boffins' TONTOU attack slips through Spectre defenses on Intel and AMD CPUs — The Register
