MIT researchers bypass Spectre v2 mitigations, leak Linux kernel data on AMD, Intel
This digest was compiled by AI from multiple sources — links to the originals are below.
MIT CSAIL researchers have bypassed Spectre v2 speculative execution mitigations, leaking sensitive data from Linux systems on AMD and Intel processors. The attack exploits a time-of-neutralization-to-time-of-use window in branch predictor defenses, allowing data extraction with 91.97% accuracy, including password hashes. AMD has acknowledged the issue, linking it to the Linux Safe RET mitigation implementation.
Spectre v2 Bypass Discovery
Researchers at MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) developed an exploit that circumvents recent mitigations for Branch Target Injection (BTI), the vulnerability underlying Spectre v2. The attack targets defenses on AMD and Intel processors that attempt to neutralize or isolate indirect branch predictors. By injecting precise timer interrupts during kernel execution, an unprivileged user program can redirect the CPU to an interrupt handler, re-poisoning the branch predictor state after it is cleared but before it is used. The technique was demonstrated on an AMD Zen 2 system running Linux, leaking arbitrary kernel memory at a rate of 5.47 bytes per second with 91.97% accuracy.
Attack Mechanics and Impact
The flaw hinges on a time-of-neutralization to time-of-use (TONTOU) window in Spectre v2 defenses, where a gap exists between when the branch predictor is neutralized and when it is actually used. The MIT team's interrupt injection method forces the kernel to handle an interrupt precisely within this window, enabling "re-poisoning" of the predictor. In tests, the attack successfully extracted data including password hashes from the /etc/shadow file. While also feasible on Intel chips, the attack requires additional software steps, making it more complex. AMD has acknowledged the vulnerability, noting it pertains to the Linux Safe RET mitigation implementation.
What's Next
AMD and Intel are expected to review and patch the mitigation bypass, though timelines remain unspecified. Researchers caution that similar TONTOU vulnerabilities may exist in other speculative execution defenses, leaving systems at risk until comprehensive fixes are deployed.
1 source
MIT researchers bypass Spectre v2 mitigations, leak Linux kernel data on AMD, Intel
