Modern CPUs boost performance by speculatively predicting branch directions. When a prediction is wrong the speculative work is discarded, but tiny side‑effects remain. Spectre showed that attackers can read those remnants to extract secrets. MIT CSAIL researchers Daniël Trujillo and Mengjia Yan discovered that most mitigations rely on the assumption that the predictor can be wiped exactly at the moment it is used. In reality there is always a non‑zero instruction gap between the wipe and the first use, sometimes only a few instructions wide, and anything executed in that gap can re‑contaminate the predictor. They call this class of attacks TONTOU.
The authors inject code into the gap by exploiting interrupt injection. By programming a high‑precision timer they force the processor to take an interrupt at the precise wrong instant; the interrupt handler then writes into the predictor. Tests on four generations of Intel and AMD CPUs produced mispredictions on both. On Intel the attack bypassed an older software‑only mitigation and a newer silicon‑level one; on AMD it broke the “saferet” mitigation, whose vulnerable window is only two instructions (tens of nanoseconds) wide, by deliberately slowing the core at that point.
To demonstrate impact they built a working exploit on a current Linux kernel running on AMD hardware. After disabling OS address‑space layout randomization, they read protected memory at roughly five bytes per second—slow but enough to locate and copy /etc/shadow in half of the attempts. The paper proposes a second clean‑up after the interrupt finishes, which appears feasible on AMD but could backfire on Intel because the attack relies on the interrupt leaving a consistent state rather than a particular one. Blocking interrupts during the window would incur unacceptable performance loss.
MIT notified AMD and Intel in early February and coordinated with Linux kernel maintainers in March. AMD released a patch that mitigates the issue; users obtain it by updating their OS. The exploit code is publicly released. The work was funded in part by the U.S. Air Force Office of Scientific Research, DARPA’s JUMP 2.0 program, and was presented at Black Hat USA and USENIX Security.
Blogger's Review: TONTOU highlights how micro‑architectural timing gaps can invalidate even well‑intended mitigations, urging hardware designers to rethink “instantaneous” assumptions in future security mechanisms.