A New Spectre Variant Bypasses Recent Fixes, Leaks Linux Password Hashes
A team of researchers from MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) has discovered a novel way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks. The method, dubbed TONTOU, exploits a previously unknown vulnerability in modern processors’ indirect branch predictors, allowing attackers to leak sensitive data, including Linux password hashes.
The researchers, Daniël Trujillo and Mengjia Yan, found that the attack works against Spectre v2 defenses on AMD and Intel processors that rely on sanitizing or isolating branch predictors. This type of mitigation is designed to prevent attacks like Spectre v2 by cleaning up the processor’s indirect branch predictor after a certain time period. However, Trujillo and Yan discovered a window of opportunity between when the branch predictor is isolated and when it is used again, which they dubbed the “Time-of-Neutralization to Time-of-Use” (TONTOU) window.
During this time, an attacker can inject interrupts into the system, causing the kernel to redirect its execution flow. The researchers then use a technique called interrupt injection to poison the processor’s indirect branch predictor, enabling them to exploit all types of indirect branches. This allows them to leak data from the kernel, including sensitive information like password hashes.
The attack was tested on both Intel and AMD processors, with the researchers successfully extracting arbitrary kernel memory at a rate of 5.47 bytes/s and 91.97% accuracy on an AMD Zen 2 system running Linux version 6.14.0-37-generic. The attack took an average of 18 minutes to complete across 10 test runs.
While the attack is possible on Intel machines, the researchers noted that additional software requirements make it more complex. However, they emphasized that their goal was not to demonstrate a practical exploit but rather to highlight the vulnerabilities in current mitigations and encourage further research into the issue.
The discovery of TONTOU highlights the ongoing challenges in defending against speculative execution attacks like Spectre v2. As processors continue to evolve, so do the attack techniques used by malicious actors. It is essential for organizations and individuals to stay up-to-date with the latest security patches and best practices to protect themselves from these types of threats.
To mitigate this risk, users can take a few precautions: ensure their systems are running the latest kernel versions and Spectre v2 mitigations, regularly review system logs for signs of suspicious activity, and consider implementing additional security measures like hardware-based isolation or secure enclaves. By being proactive and vigilant, individuals and organizations can reduce their exposure to these types of attacks and protect sensitive data from falling into the wrong hands.
Source: Bleeping Computer — 2026-08-06