New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes

New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes
Researchers discovered a way to bypass recent Spectre v2 mitigations on Intel and AMD processors by exploiting a Time-of-Neutralization to Time-of-Use window. Their attack can leak sensitive Linux kernel data, including hashed passwords from /etc/shadow, and was presented at Black Hat USA by MIT CSAIL researchers Daniël Trujillo and Mengjia Yan. #SpectreV2 #BranchTargetInjection #Linux #Intel #AMD #MITCSAIL #BlackHatUSA

Keypoints

  • The attack bypasses neutralization-based Spectre v2 mitigations.
  • It exploits a TONTOU window between branch predictor cleaning and use.
  • Interrupt injection is used to poison microarchitectural state during kernel execution.
  • The exploit can leak arbitrary Linux kernel memory with high accuracy.
  • The technique was demonstrated on AMD Zen 2 and tested on Intel systems too.

Read More: https://www.bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes/