TONTOU attack bypasses Spectre v2 defenses

A new speculative-execution attack can bypass key Spectre v2 defenses on AMD and Intel processors, allowing an unprivileged program on a Linux system to leak data from the kernel. In tests on an AMD Zen 2 machine, researchers recovered arbitrary kernel memory—including password hashes from /etc/shadow—at a rate of 5.47 bytes per second.

The technique, called TONTOU for “Time-of-Neutralization to Time-of-Use,” targets a timing gap in mitigations that sanitize or isolate a processor’s branch predictor. Spectre v2, also known as Branch Target Injection, abuses indirect branch prediction: an attacker manipulates the predictor so the CPU speculatively follows an attacker-influenced path before the correct branch target is known.

How TONTOU bypasses Spectre v2 defenses

Modern defenses such as eIBRS on Intel and Safe RET on AMD attempt to neutralize branch-predictor state before a victim branch executes. The researchers found that the interval between those two events creates an opportunity to poison the predictor again.

Daniël Trujillo, a PhD student, and Mengjia Yan, an associate professor at MIT’s Computer Science and Artificial Intelligence Laboratory, developed an Interrupt Injection technique to exploit that window. An unprivileged process schedules timer interrupts during kernel execution, forcing the kernel into an interrupt handler. That handler can then manipulate microarchitectural state after the mitigation has run but before the protected branch is used.

“An attacker without any special access to read arbitrary memory from the system, including sensitive data such as hashed passwords,”

The attack has four broad stages: neutralizing the predictor, redirecting execution, poisoning the predictor, and using the poisoned state. The researchers used repeated hardware interrupts, precise timing, and both active and passive poisoning methods to overcome the practical challenges.

Recommended reading

AI security’s real advantage is accountability

×

Password hashes recovered from AMD Zen 2

The researchers tested TONTOU on AMD and Intel processors. Their full demonstration used an AMD Zen 2 system running Linux 6.14.0-37-generic with 16GB of RAM and the latest Spectre v2 mitigations.

The attack leaked arbitrary kernel memory with 91.97% accuracy. It located and extracted /etc/shadow in five of 10 test runs, with each successful attempt taking an average of 18 minutes. That file stores Linux password hashes, not plaintext passwords, but access to it would still give an attacker sensitive authentication material for offline cracking or further attacks.

The attack also works against indirect branches generally. The researchers said interrupt injection can poison the Return Stack Buffer, producing speculative mispredictions of return targets. Because passive RSB pollution is less reliable, they combined interrupt injection with Inception, an earlier attack that Trujillo also helped develop.

×

AMD has acknowledged the interrupt-injection issue

AMD published an advisory saying the interrupt-injection problem “appears to be associated” with the Linux implementation of its Safe RET mitigation for potential information-disclosure attacks. Trujillo and Yan presented the findings at Black Hat USA and are scheduled to share further details at USENIX Security 2026, from October 27 to 29.

The reporting does not identify a new kernel patch, processor microcode update, or mitigation that fully closes the window. It also does not establish that the technique works outside the researchers' test conditions or provide comparable performance results for Intel systems; the researchers said Intel exploitation requires additional software and is more complex.

TONTOU is therefore a serious warning that “fixed” Spectre defenses can still contain exploitable microarchitectural timing gaps, but the demonstrated attack is neither fast nor simple: it requires arbitrary unprivileged code on the target, careful interrupt alignment, and repeated attempts. The immediate significance is less a broad password-theft campaign than evidence that current AMD and Intel mitigations do not eliminate speculative-execution risk—and that the missing vendor guidance now matters as much as the research result itself.