TONTOU-атака обходит защиту от Spectre v2 на процессорах AMD и Intel

MIT researchers have introduced a new class of attacks called TONTOU (Time-of-Neutralization to Time-of-Use) that circumvents Spectre v2 mitigations on both AMD and Intel processors. The technique exploits a narrow time window between the activation of branch predictor protection mechanisms like eIBRS and Safe RET, allowing attackers to inject hardware interrupts that reset the predictor state before it can be safely utilized. A proof-of-concept exploit demonstrated on AMD Zen 2 systems running Linux was able to extract sensitive data such as /etc/shadow with high precision. In response, AMD has issued security bulletin AMD-SB-7061 acknowledging the issue across Zen 1–Zen 4 architectures, while a patch has been integrated into the Linux kernel to modify register behavior after interruptions.