MIT boffins' TONTOU attack slips through Spectre defenses on Intel and AMD CPUs
Timer interrupts reopen branch predictor poisoning window, with a working Zen 2 exploit to prove it
MIT researchers Daniël Trujillo and Mengjia Yan have developed a new speculative execution attack that can bypass defenses against Spectre v2, which they call TONTOU, for Time-of-Neutralization to Time-of-Use. The attack targets mitigations designed to neutralize potentially hostile branch predictor states before sensitive code runs, but it shows that attackers can re-poison the branch predictor during the post-neutralization window.
The researchers demonstrated that their attack works on both Intel and AMD-based Linux systems, using an interrupt injection primitive to trigger interrupts during the post-neutralization window and divert control flow to leak kernel data through a side channel. However, practical attacks are difficult and the researchers note that each end-to-end attempt took about 18 minutes.
Brief written by urgent.news from The Register Science's own syndicated text. Machine-written — it may contain errors, so check the original before relying on it.
