New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes
Successfully exploiting the issue requires overcoming several obstacles, including redirecting kernel control flow, precisely aligning interrupts with the post-neutralization window, and using the interrupt handler to poison the branch predictor entry associated with the target indirect branch.
The researchers address these challenges through installing ‘timers’ to trigger hardware interrupts, frequent injection of interrupts, and via active and passive poisoning methods.
The attack was tested on both Intel and AMD processors. On an AMD Zen 2 system running Linux version 6.14.0-37-generic with 16GB of RAM, the researchers showed it could leak arbitrary kernel memory at a rate of 5.47 bytes/s and 91.97% accuracy, including the contents of / etc / shadow, which stores password hashes.
Across 10 test runs, the attack successfully located and extracted the file in five cases, with each attempt taking an average of 18 minutes.
While the attack is also possible on Intel machines, they noted that additional software requirements make the task more complex.
The researchers note that interrupt injection enables attacker-controlled poisoning of the Return Stack Buffer (RSB), causing speculative mispredictions of return targets.
Because passive RSB pollution is less reliable, they combined interrupt injection with Inception, a previously disclosed attack that Daniël Trujillo helped develop.
AMD has published an advisory today noting that the interrupt inject issue “appears to be associated” with how implementation on Linux of the Safe RET mitigation against potential information disclosure attacks.
Daniël Trujillo and Mengjia Yan presented their findings today at the Black Hat USA security conference. They will also share the details at the USENIX Security 2026 between October 27 and 29.
