“An attacker without any special access to read arbitrary memory from the system, including sensitive data such as hashed passwords,” Trujillo told BleepingComputer.
The TONTOU technique and why it matters
Researchers at MIT CSAIL have identified a timing gap in current Spectre v2 defenses and turned it into a working exploit. Daniël Trujillo, a PhD student, and associate professor Mengjia Yan describe a Time-of-Neutralization to Time-of-Use (TONTOU) window: the brief interval after branch-predictor state has been “cleaned” by neutralization-based mitigations and before the victim code actually uses the predictor.
Spectre v2, also called Branch Target Injection (BTI), abuses a processor’s indirect branch predictor to cause speculative execution along an attacker-influenced path. Modern mitigations on Intel and AMD—examples named in the research are eIBRS on Intel and Safe RET on AMD—attempt to neutralize or isolate predictor state. The TONTOU work shows those mitigations can be undermined by re-poisoning predictor state after neutralization but before its next use.
Interrupt Injection: how the re‑poisoning primitive works
The researchers built an attack primitive they call Interrupt Injection. They write that “we can force the kernel to be redirected to the interrupt handler and use this handler to poison microarchitectural states within the post-neutralization window.” In practice that means unprivileged user-space code can schedule timer interrupts to occur during kernel execution, redirecting control flow into an interrupt handler the attacker uses to repopulate relevant microarchitectural state.
Successfully exploiting the TONTOU window requires precise alignment of interrupts with the post-neutralization interval, a way to redirect kernel execution into code the attacker can use, and methods to poison the branch predictor entry tied to the target indirect branch. The researchers implemented frequent interrupt injection and a mix of active and passive poisoning techniques to meet these requirements.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildProof of concept: Linux kernel memory and /etc/shadow
The team tested TONTOU on both AMD and Intel hardware and reported full end‑to‑end results on an AMD Zen 2 host. On a machine running Linux version 6.14.0-37-generic with 16GB of RAM they demonstrated arbitrary kernel memory leakage at 5.47 bytes per second with 91.97% accuracy. Using that channel they were able to extract the contents of /etc/shadow, the file that stores password hashes on many Linux systems.
Across 10 test runs on the AMD system the attack located and extracted the file in five cases; each successful extraction averaged about 18 minutes. The researchers say the attack is also possible on Intel processors but that “additional software requirements make the task more complex,” increasing difficulty though not eliminating feasibility.
Vendor note: AMD advisory and the Linux Safe RET link
AMD published an advisory the same day the research was presented, stating the interrupt-inject issue "appears to be associated" with how the Linux implementation of the Safe RET mitigation is applied. The advisory ties the observed exploitation vector to a specific mitigation implementation rather than to a wholly new hardware flaw, aligning with the researchers’ focus on the post-neutralization timing gap.
What this means for Linux administrators, AMD and Intel customers, and security researchers
- Linux administrators: The proof-of-concept shows an unprivileged local attacker who can run code on a host may, under certain timing and configuration conditions, extract kernel memory including password hashes. Administrators should track vendor advisories and kernel updates addressing interrupt handling and Safe RET/eIBRS interactions.
- AMD and Intel customers: The attack demonstrates a class of risk tied to neutralization-based mitigations (Safe RET on AMD, eIBRS on Intel). AMD’s advisory links the immediate issue to Linux’s implementation of Safe RET; Intel platforms were noted as vulnerable in principle but require additional software conditions.
- Security researchers and mitigations teams: The TONTOU primitive changes an implicit assumption in current mitigations—that the interval between neutralization and use cannot be abused. The researchers combined interrupt injection with other techniques (they note pairing interrupt injection with Inception for Return Stack Buffer poisoning) to get reliable mispredictions.
Daniël Trujillo and Mengjia Yan presented TONTOU at Black Hat USA and plan to publish details at USENIX Security 2026 between October 27 and 29. Their work exposes a specific, measurable gap in defenses that were thought to close Spectre v2 vectors; it shows that the time between cleaning predictor state and reusing it is not, by itself, a safe boundary. For system operators and mitigations engineers the immediate questions are concrete: which implementations of Safe RET and eIBRS leave exploitable post-neutralization windows, and how quickly can kernel and microcode changes close them?
Source: BleepingComputer — New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes
