Introduction to TONTOU CPU Attack
Researchers from the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) have found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks. The new attack, known as TONTOU, can leak secrets from Linux machines, including password hashes.
Understanding Spectre v2
Spectre v2, also known as Branch Target Injection (BTI), is a variant of the Spectre class of vulnerabilities. It exploits a processor's indirect branch predictor, causing it to mispredict the target of an indirect branch and leading to speculative execution along an attacker-influenced code path.
Modern processors use branch prediction to guess the most likely execution path and speculative execution to run instructions along that predicted path before the branch outcome is known. Spectre v2 allows an attacker to manipulate the CPU's indirect branch predictor, exposing sensitive data.
Neutralization-Based Mitigations
Neutralization-based mitigations, such as eIBRS on Intel and Safe RET on AMD, aim to sanitize or isolate branch predictors. However, researchers have found a gap between the time the branch predictor is isolated and when it is used by the victim branch. This gap, known as the Time-of-Neutralization to Time-of-Use (TONTOU) window, can be exploited by attackers.
TONTOU Attack Technique
Daniël Trujillo, a PhD student, and associate professor Mengjia Yan discovered a technique for exploiting the TONTOU window. They introduced a primitive that enables re-poisoning the CPU's state after the cleaning but before it is used. The researchers developed an Interrupt Injection attack, where unprivileged user programs can schedule timer interrupts to occur during kernel execution.
The Interrupt Injection attack forces the kernel to be redirected to the interrupt handler, which can be used to poison microarchitectural states within the post-neutralization window. The researchers found that interrupts occurring during the post-neutralization window can be used to poison the processor's indirect branch predictor, enabling attacks against all types of indirect branches.
Testing the TONTOU Attack
The researchers tested the attack on an AMD Zen 2 host with the latest Spectre v2 mitigations. They successfully ran through all the stages of a TONTOU attack: neutralization, redirection, poisoning, and the use of the poisoned branch predictors.
The attack was also tested on Intel processors, but the researchers noted that additional software requirements make the task more complex. The researchers were able to leak arbitrary kernel memory at a rate of 5.47 bytes/s and 91.97% accuracy, including the contents of /etc/shadow, which stores password hashes.
Conclusion
The TONTOU CPU attack is a significant vulnerability that can bypass Spectre v2 fixes and leak sensitive data from Linux machines. The attack highlights the need for continued research and development of mitigations against speculative execution side-channel attacks. As Daniël Trujillo noted, an attacker without any special access can read arbitrary memory from the system, including sensitive data such as hashed passwords.
The researchers' findings will be presented at the Black Hat USA security conference and the USENIX Security 2026 conference. In the meantime, security teams should be aware of the potential risks and take steps to protect their systems against the TONTOU attack.
Source: BleepingComputer