cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

TONTOU Attack Bypasses Spectre v2 Mitigations to Leak Linux Kernel Data

· Original article ↗

Summary

MIT CSAIL researchers demonstrated TONTOU, an interrupt-injection technique that re-poisons branch predictor state after Spectre v2 neutralization, leaking Linux kernel memory on tested AMD Zen 2 systems. Intel exploitation is possible but more complex.

Key points

  • TONTOU exploits the gap between branch-predictor neutralization and use in Spectre v2 mitigations, including Intel eIBRS and AMD Safe RET.
  • An unprivileged program can schedule timer interrupts during kernel execution, redirecting execution to an interrupt handler that poisons the indirect branch predictor.
  • On AMD Zen 2 running Linux 6.14.0-37-generic, the researchers reported leaking kernel memory at 5.47 bytes per second with 91.97% accuracy, including password hashes from /etc/shadow.
  • Across 10 test runs, the researchers located and extracted /etc/shadow in five cases; each attempt took an average of 18 minutes.
  • Interrupt injection can also poison the Return Stack Buffer; the researchers combined it with Inception because passive RSB pollution was less reliable.
  • The attack was tested on Intel and AMD processors, though the researchers said Intel exploitation requires additional software. AMD said the interrupt-injection issue appears associated with Linux's implementation of Safe RET.

Article Details

Attack Vectors
  • An attacker able to run arbitrary unprivileged code on a Linux target can schedule timer interrupts during kernel execution. Interrupt injection redirects execution to an interrupt handler, which can poison the indirect branch predictor after neutralization and before the victim branch uses it.
  • The researchers demonstrated speculative leakage of Linux kernel memory, including /etc/shadow password hashes, on an AMD Zen 2 system with Spectre v2 mitigations enabled. They also tested the technique on Intel processors, where they reported additional software requirements.
Defensive Notes
  • AMD published an advisory stating that the interrupt-injection issue “appears to be associated” with the Linux implementation of the Safe RET mitigation.
  • The article reports no patch or specific remediation.

MITRE ATT&CK

T1003.008 · /etc/passwd and /etc/shadowThe researchers demonstrated leaking the contents of /etc/shadow, which stores password hashes, from Linux kernel memory.

People

Daniël TrujilloMIT CSAIL PhD student who co-discovered and presented the TONTOU attack; he also helped develop the previously disclosed Inception attack.Mengjia YanMIT CSAIL associate professor who co-discovered and presented the TONTOU attack.

Vendors

AMDResearchers discovered a way to bypass recent Spectre v2 mitigations on Intel and AMD processors by exploiting a Time-of-Neutralization to Time-of-Use window.IntelResearchers discovered a way to bypass recent Spectre v2 mitigations on Intel and AMD processors by exploiting a Time-of-Neutralization to Time-of-Use window.

Products

AMD Zen 2The technique was demonstrated on AMD Zen 2 and tested on Intel systems too.eIBRSWith neutralization-based mitigations (eIBRS on Intel and Safe RET on AMD), there is a gap between the time the branch predictor is isolated and when it is used by the victim branch.LinuxTheir attack can leak sensitive Linux kernel data, including hashed passwords from /etc/shadow, and was presented at Black Hat USA by MIT CSAIL researchers Daniël Trujillo and Mengjia Yan.Safe RETWith neutralization-based mitigations (eIBRS on Intel and Safe RET on AMD), there is a gap between the time the branch predictor is isolated and when it is used by the victim branch.

Related Articles