Key Takeaways
- Speculative execution improves performance but leaves transient traces that can be read via side‑channel attacks like Spectre.
- Current defenses try to wipe or isolate branch‑prediction state before it is used, relying on the assumption that the wipe and the use happen atomically.
- MIT researchers showed this assumption fails: a tiny timing gap always exists between clearing prediction hardware and its consumption.
- By precisely injecting interrupts (timer‑driven context switches) into that gap—an approach they call interrupt injection—attackers can re‑contaminate the predictor and revive Spectre‑style leakage.
- The new class of attacks, dubbed TONTOU, works on recent Intel and AMD CPUs, bypassing both software‑based and hardware‑integrated mitigations.
- On AMD, the vulnerable window is only two instructions wide (~tens of nanoseconds); slowing the core just enough lets attackers hit it reliably.
- A proof‑of‑concept exploit on an AMD‑based Linux system read the protected
/etc/shadowfile at ~5 bytes/s, extracting the root password hash in about nine minutes per attempt. - Mitigations proposed include a second clean‑up after interrupt handling (effective on AMD) or blocking interrupts during the window (costly performance‑wise).
- AMD has already released a patch; Intel’s newer chips contain a dedicated instruction that may help, but the same fix can unintentionally strengthen the attack on some generations.
- The work was presented at Black Hat USA and USENIX Security 2024 and responsibly disclosed to AMD, Intel, and Linux maintainers.
Speculative Execution and the Spectre Problem
Modern processors boost performance by guessing the outcome of conditional branches before the actual condition is known. When the guess is correct, the CPU saves cycles; when it is wrong, the speculative work is discarded. However, microarchitectural side effects—such as changes to caches, branch‑predictor state, or translation‑lookaside buffers—can linger after the discard. Attackers exploit these remnants to infer data they should not be able to access, a class of vulnerabilities exemplified by Spectre, first disclosed in 2018. Since then, chipmakers and OS vendors have deployed a variety of mitigations aimed at erasing or isolating the predictor’s state before it is used.
How Existing Defenses Attempt to Block Spectre
The prevailing strategy is to “wipe” the branch‑prediction machinery—clearing entries, flushing buffers, or resetting predictor tables—immediately before the predictor consults its state. The idea is that any malicious information an attacker might have planted would be removed, leaving a clean slate for the next prediction. This approach implicitly assumes that the wipe and the subsequent use of the predictor occur at the same instant, i.e., that there is no window where code can run between the two operations.
The Hidden Gap: Why the Assumption Fails
PhD student Daniël Trujillo and Assistant Professor Mengjia Yan from MIT CSAIL identified that the wipe and the use cannot be perfectly synchronized. Even the most aggressive clearing instruction is followed by a non‑zero number of processor cycles before the predictor is actually consulted. This interval—sometimes only a handful of instructions wide—creates a timing gap. Any code that executes in that window can repopulate the predictor with attacker‑controlled state, nullifying the protective wipe. The researchers named this novel class of attacks TONTOU (short for “Timing‑Only Non‑Transactional Overwrite Utilization”).
Interrupt Injection: Planting Code in the Gap
To reliably land code inside the gap, Trujillo and Yan leveraged the fact that processors constantly pause normal execution to handle interrupts—small, routine tasks triggered by timers, network packets, or hardware events. Programs can configure timers with high precision, allowing them to schedule an interrupt to fire at a chosen moment. By tuning the timer so that the interrupt occurs exactly within the vulnerable window, the interrupt handler itself becomes the “contaminant” that dirties the prediction machinery after it has been cleared. They termed this technique interrupt injection.
Empirical Validation Across Intel and AMD Generations
The team tested the attack on four recent processor generations from both Intel and AMD. On Intel chips, TONTOU defeated two distinct defenses: a software‑based mitigation used on older parts and a hardware‑integrated protection built into newer silicon. Interestingly, the newer protection succeeded on one Intel generation but failed on another, indicating that vendors implement the same nominal defense in substantially different ways under the hood.
AMD’s mitigation, called saferet, clears the prediction machinery immediately before each use, leaving a purportedly vulnerable window just two instructions wide—typically on the order of tens of nanoseconds. Despite this narrow window, the researchers succeeded by deliberately slowing the core at that precise point (for example, by issuing a serializing instruction) to widen the effective target area, allowing interrupt injection to hit reliably.
From a Mis‑prediction to a Password Hash
To demonstrate real‑world impact, the researchers built a working exploit on an AMD system running a current Linux kernel. First, they disabled KASLR (kernel address space layout randomization) by removing a defense that randomizes where the OS resides in memory; this succeeded in all ten attempts, taking roughly nine minutes per try. With KASLR gone, they could read protected memory at about five bytes per second. Though slow, this bandwidth was sufficient to locate and copy the file /etc/shadow, which stores the system’s root password hash, in roughly half of their attempts. The exploit thus showed that TONTOU can leak high‑value secrets despite existing mitigations.
Proposed Mitigations and Their Trade‑offs
The paper suggests a straightforward fix: perform a second cleaning of the prediction machinery after the interrupt handler finishes. On AMD, this extra wipe appears feasible and would close the window that interrupt injection exploits. On Intel, however, the situation is more delicate. Because the attack relies on the interrupt leaving the predictor in a consistent (rather than a specific) state, a second clean‑up could actually make the attack more reliable by ensuring the predictor is in a known state that the attacker can better anticipate. Newer Intel generations already include a dedicated instruction (e.g., spec_ctrl or similar) that seems to mitigate the issue without this downside.
Another theoretical mitigation is to block interrupts entirely during the vulnerable window. While this would eliminate the attack surface, it would impose a prohibitive performance cost, as interrupts are essential for multitasking, I/O handling, and timing services. Hence, wholesale interrupt disabling is not considered practical.
Responsible Disclosure, Patching, and Outreach
Trujillo and Yan notified AMD and Intel in early February 2024 and contacted Linux kernel maintainers in March. They coordinated with AMD to inform cloud providers and other downstream customers. In response, AMD released a patch that mitigates TONTOU; users can obtain it by updating their operating systems to the latest kernel version that includes the fix. The researchers also made their exploit code publicly available to enable further scrutiny and defensive development.
Funding, Presentation, and Broader Context
The research received partial support from the U.S. Air Force Office of Scientific Research (via an award through the U.S. Department of War) and from ACE, one of seven centers in the JUMP 2.0 program sponsored by the Defense Advanced Research Projects Agency (DARPA). The findings were presented at both Black Hat USA and USENIX Security in August 2024, highlighting the continued relevance of transient‑execution attacks and the need for evolving hardware‑software co‑design to close subtle timing gaps.
In summary, the MIT study reveals that the core assumption wiping branch‑prediction state before its use is invalid due to an unavoidable timing gap. By precisely injecting interrupts into that gap—using a technique dubbed interrupt injection—attackers can revive Spectre‑style leakage on modern Intel and AMD processors. The work not only demonstrates a viable path to reading sensitive kernel data but also offers concrete mitigation paths, highlights performance‑trade‑off considerations, and underscores the importance of coordinated disclosure and patching in the face of ever‑more subtle microarchitectural threats.