Researchers discovered a way to bypass recent Spectre v2 mitigations on Intel and AMD processors by exploiting a Time-of-Neutralization to Time-of-Use window. Their attack can leak sensitive Linux kernel data, including hashed passwords from /etc/shadow, and was presented at Black Hat USA by MIT CSAIL researchers Daniël Trujillo and Mengjia Yan. #SpectreV2 #BranchTargetInjection #Linux #Intel #AMD #MITCSAIL #BlackHatUSA
Keypoints
- The attack bypasses neutralization-based Spectre v2 mitigations.
- It exploits a TONTOU window between branch predictor cleaning and use.
- Interrupt injection is used to poison microarchitectural state during kernel execution.
- The exploit can leak arbitrary Linux kernel memory with high accuracy.
- The technique was demonstrated on AMD Zen 2 and tested on Intel systems too.