The TONTOU Vulnerability
Researchers from the Massachusetts Institute of Technology (MIT), specifically Daniël Trujillo and Mengjia Yan of the Computer Science and Artificial Intelligence Laboratory (CSAIL), have developed a novel speculative execution vulnerability dubbed TONTOU, which stands for Time-of-Neutralization to Time-of-Use. This new attack method was set to be presented at DEF CON 34. The exploit successfully bypasses existing hardware protections designed to mitigate Spectre v2.
These defenses typically function by neutralizing or sanitizing the processor’s branch predictor state—a critical defense against Spectre-style attacks—before sensitive code is executed. Depending on the specific mitigation implemented, the operating system or processor is required to isolate, clear, or safely retrain the relevant predictor state when entering protected or privileged code sections.
Circumventing Modern CPU Defenses
Different hardware manufacturers deploy these protective measures uniquely. For instance, Intel utilizes eIBRS to clean branch predictors during a context switch, while AMD employs Safe RET, a mitigation co-authored by Trujillo after the 2023 Inception attack, which focuses on the moment immediately preceding a protected branch execution. The researchers refer to these methods as entry neutralization and in-place neutralization, respectively.
The core assumption underlying these defenses is that the “post-neutralization window”—the period between when the state is cleansed and when the victim branch predictor is actually used—is inherently safe. However, the TONTOU attack demonstrates how malicious actors can reintroduce poisoning into the branch predictor during this crucial post-neutralization window.
The technique achieves this through a process called “interrupt injection.” By having an unprivileged program schedule high-frequency timer interrupts, the attacker aims for an interrupt to execute within the narrow post-neutralization window. This allows the attacker to divert the system’s control flow, enabling an interrupt handler to run after the sanitization phase but before the intended victim branch executes. The handler can then re-poison predictor structures, such as the return stack buffer (RSB) or branch history buffer (BHB).
Practical Demonstration and Industry Response
By successfully re-poisoning the predictor state, the attack forces a protected branch to speculatively jump to a controlled gadget that, in turn, leaks kernel data through a side channel. The researchers confirmed that the TONTOU attacks were effective on both Intel and AMD-based Linux systems. They tested the exploit against Intel Cascade Lake Refresh and Arrow Lake processors, and AMD Zen 2 and Zen 4 chips.
The team constructed a comprehensive, end-to-end exploit specifically for Zen 2. They were able to precisely identify the moment to inject the interruptions required to poison the RSB. Through a series of operations, they successfully bypassed Linux’s Kernel Address Space Layout Randomization (KASLR), enabling them to locate specific secrets, such as the file containing the root password hash (`etc/shadow`). Across ten total attempts, the researchers consistently broke KASLR, and successfully located and leaked the contents of `etc/shadow` in five of those runs.
The researchers cautioned that while speculative side-channel attacks are inherently complex, the demonstrated exploit is practical. They noted that their tests required approximately 18 minutes to complete. Because the attack uses a standard Linux kernel version with all default mitigations, the vulnerability poses a risk to any system executing unprivileged code with timer availability while sharing the kernel, including multi-tenant container platforms.
Following the findings, the researchers notified Intel, Arm, and AMD. AMD committed to developing kernel patches to address the issue. Intel acknowledged the threat by awarding a prize from its bug bounty program but stated it would not implement additional mitigations, citing the variability of real-world exploits. Arm characterized the TONTOU interrupt injections as falling under “passive leakage,” which the company does not “actively protect against.”
