MIT boffins' TONTOU attack slips through Spectre defenses on Intel and AMD CPUs

The researchers introduced a new class of attack, dubbed TONTOU, that targets the interval between when a processor’s branch predictor is cleared and when a protected branch actually executes. By scheduling high-frequency timer interrupts, an unprivileged program can force an interrupt handler to run exactly in that gap, allowing it to rewrite predictor structures such as the return-stack buffer. This re-poisoning creates a speculative path that leaks kernel data via a side channel, directly violating the security model of existing Spectre mitigations.

Their experiments used a vanilla Linux kernel with all default mitigations enabled, showing that no special kernel modules or custom firmware are required. The attack succeeded on recent Intel models (Cascade Lake Refresh and Arrow Lake) and AMD models (Zen 2 and Zen 4), confirming that both eIBRS-based entry neutralization and Safe RET-based in-place neutralization can be subverted. The only prerequisite beyond normal operation is that the system’s timer remains available to the attacker’s code.

For engineers maintaining operating systems or virtualization layers, the finding forces a reassessment of how and when branch-predictor state is sanitized. Closing the post-neutralization window may involve delaying interrupt delivery, adding extra barriers before privileged code runs, or redesigning the neutralization points to be atomic with respect to interrupts. Each of these options can increase latency or reduce throughput, so trade-offs between security and performance must be evaluated.

The attack is not trivial to execute at scale: it relies on precise timing, and the researchers reported an average of 18 minutes to complete a full exploit on AMD Zen 2. The Intel variant required particular software conditions that were not present in the default test, indicating that the method may not be universally applicable without additional setup. Consequently, while the technique is practical for targeted attacks, it remains less convenient than many other threat vectors.

Although speculative-execution attacks are becoming more sophisticated, the authors note that they are still harder to pull off than common ransomware attacks. Nonetheless, environments that handle highly sensitive data or run untrusted code alongside privileged kernels should treat this as a concrete risk. Updating mitigation strategies now can prevent the need for more invasive patches later, especially as future CPUs may inherit similar post-neutralization windows.