MIT researchers uncover Spectre attack that bypasses Intel and AMD defences

Spectre-style attacks remain a persistent security concern for modern processors, with researchers continuing to find ways around protections introduced since the original vulnerability was disclosed in 2018. Researchers at the Massachusetts Institute of Technology (MIT) have now identified a new technique that can bypass some of the safeguards used by Intel and AMD processors.

The attack, named TONTOU, exploits a short period between the neutralisation of information used by a processor’s branch predictor and the point at which the prediction machinery is actually used. The researchers say this small timing gap can allow an attacker to interfere with branch prediction again, potentially exposing sensitive information.

Daniël Trujillo and Mengjia Yan conducted the research at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL). Their findings demonstrate that even defences designed specifically to address Spectre-related attacks can leave small windows that may be exploitable under carefully controlled conditions.

TONTOU targets a narrow gap in CPU protections

Spectre attacks exploit speculative execution, a technique used by modern processors to improve performance. CPUs attempt to predict which instructions software will execute next and begin processing them before the outcome is known. If the prediction is incorrect, the processor discards the unwanted results, but traces of the activity can sometimes remain in internal processor structures.

Those traces can potentially be measured through side-channel techniques, allowing an attacker to infer information that should otherwise remain protected. Following the discovery of Spectre, processor manufacturers introduced various measures to prevent attackers from manipulating branch prediction mechanisms before sensitive operations occur.

According to the MIT researchers, however, neutralising the relevant processor state and subsequently using the branch predictor are separate events. This creates what they describe as a “post-neutralisation window”. TONTOU, which stands for Time-of-Neutralization to Time-of-Use, is designed to exploit this brief interval.

The researchers used a technique known as interrupt injection to manipulate processor timing carefully. High-frequency timer interrupts are scheduled to land within the short window, allowing an attacker to poison prediction structures again. The technique can target structures including the return stack buffer and branch history buffer, which help processors predict how software will execute.

The researchers tested their approach on several Intel and AMD processors, including Intel’s Cascade Lake Refresh and Arrow Lake chips and AMD’s Zen 2 and Zen 4 architectures. They were able to produce the required branch mispredictions on both processor families, demonstrating that the problem is not limited to a single CPU design.

AMD’s Safe RET defence leaves a particularly narrow window for the attack. The researchers found that the relevant window could be only two instructions wide and typically last for tens of nanoseconds. Despite the extremely short timeframe, the researchers were able to manipulate processor timing sufficiently to target it.

Researchers demonstrate data leakage on AMD hardware

The MIT team also demonstrated that TONTOU could be used as part of a practical exploit rather than remaining solely a theoretical attack. On an AMD Zen 2 system running a standard Linux kernel, the researchers developed an end-to-end attack capable of bypassing Linux’s kernel address space layout randomisation, or KASLR.

The researchers successfully defeated KASLR in all 10 of their attempts. In five of those runs, they were able to identify and leak the location of /etc/shadow, a Linux file containing password hashes for privileged accounts. The results show that the timing weakness can have security consequences when combined with other techniques.

However, TONTOU is far from being a fast or straightforward method of stealing information. The researchers measured a protected-memory reading rate of around five bytes per second. The Register also reported that a complete exploit attempt could take about 18 minutes and that specific software conditions were required for attacks involving Intel processors.

This means TONTOU is not considered a practical threat to ordinary desktop users in the same way as conventional malware. The attack requires significant technical knowledge, precise timing and a suitable environment in which the necessary conditions can be established.

The researchers disclosed their findings to AMD and Intel in February, followed by notification to Linux kernel maintainers in March. AMD subsequently released a kernel patch intended to mitigate the attack, making software updates particularly important for systems running affected processors.

Intel, meanwhile, told the researchers that it does not intend to introduce additional mitigations for TONTOU. The company cited the number of conditions required for successful exploitation, including the availability of suitable disclosure gadgets. Intel nevertheless recognised the research with a bug-bounty payment.

The discovery highlights the continuing difficulty of completely addressing Spectre-related weaknesses. Rather than exposing a simple flaw that can be fixed with a single software update, TONTOU exploits the complex interactions among processor timing, speculative execution, and security protections.

For most PC owners, the research does not represent an immediate reason for concern. The greater risk is likely to exist in environments such as cloud services, shared computing systems and multi-tenant infrastructure, where untrusted code may run alongside sensitive workloads. TONTOU nevertheless demonstrates that Spectre’s underlying security challenges remain relevant years after the original attacks were disclosed.