Researchers at MIT have discovered a technique that bypasses recent Spectre v2 mitigations on AMD and Intel processors, potentially allowing unprivileged attackers to extract sensitive data including hashed passwords from Linux systems.

The attack, called TONTOU (Time-of-Neutralization to Time-of-Use), exploits a window between when processors clean their branch predictor state and when that state is used. PhD student Daniël Trujillo and associate professor Mengjia Yan of MIT's Computer Science and Artificial Intelligence Laboratory developed an Interrupt Injection method that lets unprivileged user programs schedule timer interrupts during kernel execution, allowing them to re-poison the CPU's state after cleaning but before use.

The researchers successfully demonstrated the attack on an AMD Zen 2 processor with the latest Spectre v2 mitigations, running through all stages of the exploit: neutralization, redirection, poisoning, and use of the poisoned branch predictors, Ionut Ilascu reports for BleepingComputer.