TONTOU CPU Attack: A New Spectre v2 Bypass
Daniël Trujillo and Mengjia Yan from MIT CSAIL unveiled a new way to bypass existing Spectre v2 defenses today at Black Hat USA. Their Interrupt Injection attack, also known as TONTOU, targets a very specific, narrow timing window on the CPU. This novel TONTOU CPU attack represents a significant evolution in speculative execution vulnerabilities, demonstrating how even robust mitigations can be circumvented by precise timing.
The attack unfolds when an unprivileged Linux program sets up the conditions, timing a hardware interrupt precisely. The CPU prepares for a secure operation, such as a kernel call or context switch. During this critical phase, Spectre v2 mitigations, like AMD's Safe-RET, run to sanitize the branch predictor, clearing any potentially malicious speculative state that could lead to information leakage. This is the intended security mechanism designed to prevent speculative execution attacks.
However, a tiny, critical gap exists: the "Time-of-Neutralization to Time-of-Use" window. In the brief period after Spectre v2 defenses have run but before the kernel actually uses the sanitized branch predictor, the attacker injects a hardware interrupt. This interrupt, precisely timed, reintroduces malicious speculative state into the branch predictor, effectively making it vulnerable again. The kernel then proceeds, unknowingly using a compromised branch predictor, allowing sensitive data to be leaked. This race condition exploits the fundamental interaction between interrupt handling and speculative execution mitigation, a challenge that has proven difficult to fully address.
The researchers demonstrated this vulnerability on Linux 6.14. This bypass exploits a fundamental race condition in how the CPU handles interrupts relative to its speculative execution mitigations. The precise timing required for the TONTOU CPU attack highlights the increasing sophistication of side-channel attacks, moving from broad architectural flaws to micro-architectural timing discrepancies.
What This Means for Your Linux Box
This isn't merely a theoretical exploit; its practical impact is significant and far-reaching. On AMD Zen 2 processors, the researchers demonstrated the ability to leak arbitrary kernel memory at 5.47 bytes per second with 91.97% accuracy. More alarmingly, they successfully accessed sensitive files like /etc/shadow, which contains hashed user passwords, in five of ten attempts. This direct access to critical system files underscores the severity of the TONTOU CPU attack.
The attack requires only local code execution. This means if an attacker can run *any* unprivileged program on your Linux system, they could potentially steal password hashes. This presents a significant risk for shared systems, such as multi-tenant cloud environments where different users share the same physical hardware, or even a workstation running untrusted code from a web browser or an email attachment. Organizations relying on strong isolation between user processes must take this vulnerability seriously.
The TONTOU CPU attack was demonstrated on AMD Zen 1 and Zen 2 architectures, with Zen 3 and Zen 4 also suggested as affected due to similar micro-architectural characteristics. On the Intel side, mispredictions were observed on Arrow Lake and Cascade Lake Refresh processors. While an end-to-end attack on Intel has not been fully demonstrated by the researchers, they believe it is entirely possible by combining Interrupt Injection with existing disclosure gadgets. This implies that Intel systems, though not yet fully exploited in a public demonstration, remain at considerable risk.
Why AMD Patched and Intel Didn't
AMD was notified of the vulnerability on February 5, 2026. They acknowledged the "Safe RET Interrupt Vulnerability" (AMD-SB-7061) affecting Zen 1 through Zen 4 processors. Demonstrating a proactive security posture, AMD has since shipped a kernel patch, with the Linux kernel commit "x86/bugs: Make Safe-RET robust against interrupt injection" dated June 2, 2026, fixing the issue. AMD's bulletin, published today, August 6, 2026, confirms the vulnerability and the fix, though it notably does not provide a specific patch reference, kernel version, or CVE at the time of writing. This swift action by AMD provides a clear path to mitigation for their users.
Intel also received disclosure on February 5, 2026. Their response, however, was markedly different: they do not consider mitigation necessary. They stated that exploitability "depends on many factors" and is covered by existing guidance. While Intel did pay a discretionary bug bounty bonus, they ultimately decided against patching. Their guidance (INTEL-SA-00598, last updated May 2025) makes no mention of interrupts in this context, suggesting a potential gap in their existing threat model regarding this specific attack vector. This divergence in vendor response creates a complex security landscape for users.
Intel's stance seems to hinge on the need for an additional "disclosure gadget" to turn the misprediction into a full data leak. For security researchers, finding such gadgets is often a matter of time and effort, a challenge that determined attackers typically overcome. While this distinction might be significant for defenders in a theoretical sense, it's often less of a deterrent for determined attackers who are motivated to achieve full exploitation. This philosophical difference in assessing risk directly impacts the security posture of millions of systems.
As of today, August 6, 2026, the Linux kernel documentation for /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow still does not mention interrupts, underscoring how recently this specific attack vector has emerged and how quickly the landscape of CPU vulnerabilities is evolving. This lack of immediate documentation update further highlights the novelty and complexity of the TONTOU CPU attack.
The Evolving Challenge of Speculative Execution Vulnerabilities
The TONTOU CPU attack, or Interrupt Injection, underscores the persistent and escalating challenge of speculative execution vulnerabilities. Even with existing mitigations like Spectre v2 fixes, attackers are continually finding new, incredibly narrow timing windows to exploit. This ongoing cat-and-mouse game between researchers, attackers, and CPU vendors means that vigilance and rapid patching remain paramount.
AMD's decision to patch shows they recognize the immediate and tangible risk posed by the TONTOU CPU attack. Their proactive approach provides a clear security benefit to their users. Intel's decision not to patch, while perhaps technically defensible from their perspective regarding end-to-end exploitability, leaves their users reliant on the assumption that those "many factors" will always prevent a full leak. This reliance on 'existing guidance' for a novel bypass technique is a significant risk, especially when dealing with sensitive data like password hashes in critical environments.
Therefore, for anyone running Linux on affected Intel or AMD hardware, updating your kernel to at least the June 2, 2026, patch level or newer is essential. Beyond patching, organizations should implement robust security practices, including least privilege principles, regular security audits, and monitoring for unusual activity, especially in shared or multi-tenant environments. The TONTOU CPU attack serves as a stark reminder that the battle against micro-architectural vulnerabilities is far from over, demanding continuous attention and adaptation from the entire security community. Learn more about cutting-edge research from MIT CSAIL.
