TONTOU Attack: How MIT CSAIL Researchers Bypassed Spectre v2 Defenses on AMD and Intel CPUs
MIT CSAIL researchers Daniël Trujillo and Mengjia Yan developed TONTOU (Time of Neutralization to Time of Use), a new attack class exploiting a two instruction window in AMD's Safe RET mitigation to re poison branch p... The attack successfully extracted Linux /etc/shadow password hashes in 5 out of 10 attempts, eac...
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
MIT CSAIL researchers Daniël Trujillo and Mengjia Yan developed TONTOU (Time of Neutralization to Time of Use), a new attack class exploiting a two instruction window in AMD's Safe RET mitigation to re poison branch p...
The attack successfully extracted Linux /etc/shadow password hashes in 5 out of 10 attempts, each taking approximately 18 minutes, using only unprivileged user space code.
AMD acknowledged the vulnerability (AMD SB 7061), and patches were committed to the Linux kernel on June 2, 2026, shipping in versions 7.1.7, 6.18.43, 6.6.149, and 6.1.181 to address CVE 2026 68480.
How did MIT CSAIL researchers bypass existing Spectre v2 CPU defenses (eIBRS and Safe RET) on AMD and Intel processors using a technique calAI-generated illustration of a processor vulnerability being exploited through speculative execution.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: How did MIT CSAIL researchers bypass existing Spectre v2 CPU defenses (eIBRS and Safe RET) on AMD and Intel processors using a technique cal. Article summary: Here is a complete, evidence-backed answer to your question.. Topic tags: general, education, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait thumbnails, icons, and tiny thumbnail layouts. Make it useful as an illustrative visual, not as factual evidence.
openai.com
Spectre v2 (Branch Target Injection) defenses were supposed to be mature. Intel's enhanced Indirect Branch Restricted Speculation (eIBRS) and AMD's Safe RET, the two primary mitigations deployed across millions of processors, were designed to sanitize branch predictor state and prevent speculative side-channel leaks. Researchers at MIT CSAIL have now demonstrated that these mitigations contain a fundamental timing flaw that attackers can exploit.
Dubbed TONTOU — Time-of-Neutralization to Time-of-Use — the attack class exploits a tiny window between when a processor's branch predictor is "neutralized" and when the kernel actually uses it . The researchers, PhD student Daniël Trujillo and Associate Professor Mengjia Yan, presented their findings at Black Hat USA on August 6, 2026, and the full academic paper was accepted at USENIX Security 2026 .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "TONTOU Attack: How MIT CSAIL Researchers Bypassed Spectre v2 Defenses on AMD and Intel CPUs"?
MIT CSAIL researchers Daniël Trujillo and Mengjia Yan developed TONTOU (Time of Neutralization to Time of Use), a new attack class exploiting a two instruction window in AMD's Safe RET mitigation to re poison branch p...
What are the key points to validate first?
MIT CSAIL researchers Daniël Trujillo and Mengjia Yan developed TONTOU (Time of Neutralization to Time of Use), a new attack class exploiting a two instruction window in AMD's Safe RET mitigation to re poison branch p... The attack successfully extracted Linux /etc/shadow password hashes in 5 out of 10 attempts, each taking approximately 18 minutes, using only unprivileged user space code.
What should I do next in practice?
AMD acknowledged the vulnerability (AMD SB 7061), and patches were committed to the Linux kernel on June 2, 2026, shipping in versions 7.1.7, 6.18.43, 6.6.149, and 6.1.181 to address CVE 2026 68480.
TONTOU Attack: How MIT CSAIL Researchers Bypassed Spectre v2 Defenses on AMD and Intel CPUs
MIT CSAIL researchers Daniël Trujillo and Mengjia Yan developed TONTOU (Time of Neutralization to Time of Use), a new attack class exploiting a two instruction window in AMD's Safe RET mitigation to re poison branch p... The attack successfully extracted Linux /etc/shadow password hashes in 5 out of 10 attempts, eac...
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
MIT CSAIL researchers Daniël Trujillo and Mengjia Yan developed TONTOU (Time of Neutralization to Time of Use), a new attack class exploiting a two instruction window in AMD's Safe RET mitigation to re poison branch p...
The attack successfully extracted Linux /etc/shadow password hashes in 5 out of 10 attempts, each taking approximately 18 minutes, using only unprivileged user space code.
AMD acknowledged the vulnerability (AMD SB 7061), and patches were committed to the Linux kernel on June 2, 2026, shipping in versions 7.1.7, 6.18.43, 6.6.149, and 6.1.181 to address CVE 2026 68480.
How did MIT CSAIL researchers bypass existing Spectre v2 CPU defenses (eIBRS and Safe RET) on AMD and Intel processors using a technique calAI-generated illustration of a processor vulnerability being exploited through speculative execution.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: How did MIT CSAIL researchers bypass existing Spectre v2 CPU defenses (eIBRS and Safe RET) on AMD and Intel processors using a technique cal. Article summary: Here is a complete, evidence-backed answer to your question.. Topic tags: general, education, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait thumbnails, icons, and tiny thumbnail layouts. Make it useful as an illustrative visual, not as factual evidence.
openai.com
Spectre v2 (Branch Target Injection) defenses were supposed to be mature. Intel's enhanced Indirect Branch Restricted Speculation (eIBRS) and AMD's Safe RET, the two primary mitigations deployed across millions of processors, were designed to sanitize branch predictor state and prevent speculative side-channel leaks. Researchers at MIT CSAIL have now demonstrated that these mitigations contain a fundamental timing flaw that attackers can exploit.
Dubbed TONTOU — Time-of-Neutralization to Time-of-Use — the attack class exploits a tiny window between when a processor's branch predictor is "neutralized" and when the kernel actually uses it . The researchers, PhD student Daniël Trujillo and Associate Professor Mengjia Yan, presented their findings at Black Hat USA on August 6, 2026, and the full academic paper was accepted at USENIX Security 2026 .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "TONTOU Attack: How MIT CSAIL Researchers Bypassed Spectre v2 Defenses on AMD and Intel CPUs"?
MIT CSAIL researchers Daniël Trujillo and Mengjia Yan developed TONTOU (Time of Neutralization to Time of Use), a new attack class exploiting a two instruction window in AMD's Safe RET mitigation to re poison branch p...
What are the key points to validate first?
MIT CSAIL researchers Daniël Trujillo and Mengjia Yan developed TONTOU (Time of Neutralization to Time of Use), a new attack class exploiting a two instruction window in AMD's Safe RET mitigation to re poison branch p... The attack successfully extracted Linux /etc/shadow password hashes in 5 out of 10 attempts, each taking approximately 18 minutes, using only unprivileged user space code.
What should I do next in practice?
AMD acknowledged the vulnerability (AMD SB 7061), and patches were committed to the Linux kernel on June 2, 2026, shipping in versions 7.1.7, 6.18.43, 6.6.149, and 6.1.181 to address CVE 2026 68480.
Spectre v2 mitigations like eIBRS and Safe RET work by sanitizing or isolating branch predictor state at privilege boundaries — for example, when switching from user space to kernel space . The key assumption in these defenses was that attackers could not manipulate the predictor in the brief interval after sanitization but before the predictor is consulted.
TONTOU invalidates that assumption. On AMD's Safe RET, the vulnerable window is just two instructions wide . An unprivileged attacker can inject a precisely-timed hardware interrupt (called INTERRUPT INJECTION) that lands in that gap, re-poisoning the branch predictor after the defense has already run but before the kernel consumes the predictor state . This re-enables speculative execution side-channel leakage despite all intended protections being in place.
The attack requires only the ability to run unprivileged user-space code on the target machine. No elevated privileges are needed .
Demonstrated Impact: Leaking Linux Password Hashes
The researchers built a full end-to-end exploit and tested it across multiple processor generations:
Tested processors: Intel Cascade Lake Refresh, Intel Arrow Lake, AMD Zen 2, and AMD Zen 4 .
On an AMD Zen 2 system running Linux 6.14.0-37-generic with 16GB RAM and default Spectre v2 protections, the attack leaked arbitrary kernel memory at 5.47 bytes per second.
The leak achieved 91.97% accuracy on the extracted data .
The researchers successfully located and extracted the contents of /etc/shadow (containing Linux password hashes) in five out of ten attempts, with each attempt taking approximately 18 minutes.
On Intel platforms, the researchers demonstrated partial bypass of eIBRS on Cascade Lake Refresh and Arrow Lake, though the attack surface differs from the AMD Safe RET case . The study did not confirm successful branch misdirection on AMD Zen 4 using the same method .
Industry Response and Patches
The disclosure and response timeline was swift:
February 5, 2026: Researchers coordinated disclosure to AMD, Intel, and Arm .
June 2, 2026: Linux kernel patches were committed, authored by AMD's Borislav Petkov, with the commit title "x86/bugs: Make Safe-RET robust against interrupt injection" .
August 5, 2026: The patch was accepted into the mainline Linux kernel .
August 6, 2026: AMD published security bulletin AMD-SB-7061 ("Safe RET Interrupt Vulnerability"), naming Zen 1 through Zen 4 processors as affected. AMD assessed the issue as tied to the Linux implementation of Safe RET for the Speculative Return Stack Overflow (SRSO) mitigation rather than the processor architecture alone .
August 6, 2026: The patch shipped in Linux kernel versions 7.1.7, 6.18.43, 6.6.149, and 6.1.181, addressing CVE-2026-68480.
Intel acknowledged the findings during the coordinated disclosure process and awarded a prize from its bug bounty program, but told researchers it would not develop additional mitigations, citing factors such as the availability of disclosure gadgets needed for real-world exploitation .
Implications for CPU Security
TONTOU represents a significant evolution in speculative execution attacks. Unlike earlier Spectre variants that targeted the core prediction mechanism itself, TONTOU attacks the mitigation — the very software and hardware defenses built to stop previous attacks. By identifying a race condition between neutralization and use, the researchers have opened a new class of vulnerability that will require fundamentally different defensive approaches.
The attack also demonstrates that CPU security cannot be solved by software patches alone. While the Linux kernel fix closes the specific interrupt injection window on AMD Zen processors, the underlying architectural assumption — that predictor sanitization and predictor usage can be treated as an atomic operation — has been proven false.
webpronews.comMIT's TONTOU Attack Pierces Spectre Shields on Intel and AMD Processors
Spectre v2 mitigations like eIBRS and Safe RET work by sanitizing or isolating branch predictor state at privilege boundaries — for example, when switching from user space to kernel space . The key assumption in these defenses was that attackers could not manipulate the predictor in the brief interval after sanitization but before the predictor is consulted.
TONTOU invalidates that assumption. On AMD's Safe RET, the vulnerable window is just two instructions wide . An unprivileged attacker can inject a precisely-timed hardware interrupt (called INTERRUPT INJECTION) that lands in that gap, re-poisoning the branch predictor after the defense has already run but before the kernel consumes the predictor state . This re-enables speculative execution side-channel leakage despite all intended protections being in place.
The attack requires only the ability to run unprivileged user-space code on the target machine. No elevated privileges are needed .
Demonstrated Impact: Leaking Linux Password Hashes
The researchers built a full end-to-end exploit and tested it across multiple processor generations:
Tested processors: Intel Cascade Lake Refresh, Intel Arrow Lake, AMD Zen 2, and AMD Zen 4 .
On an AMD Zen 2 system running Linux 6.14.0-37-generic with 16GB RAM and default Spectre v2 protections, the attack leaked arbitrary kernel memory at 5.47 bytes per second.
The leak achieved 91.97% accuracy on the extracted data .
The researchers successfully located and extracted the contents of /etc/shadow (containing Linux password hashes) in five out of ten attempts, with each attempt taking approximately 18 minutes.
On Intel platforms, the researchers demonstrated partial bypass of eIBRS on Cascade Lake Refresh and Arrow Lake, though the attack surface differs from the AMD Safe RET case . The study did not confirm successful branch misdirection on AMD Zen 4 using the same method .
Industry Response and Patches
The disclosure and response timeline was swift:
February 5, 2026: Researchers coordinated disclosure to AMD, Intel, and Arm .
June 2, 2026: Linux kernel patches were committed, authored by AMD's Borislav Petkov, with the commit title "x86/bugs: Make Safe-RET robust against interrupt injection" .
August 5, 2026: The patch was accepted into the mainline Linux kernel .
August 6, 2026: AMD published security bulletin AMD-SB-7061 ("Safe RET Interrupt Vulnerability"), naming Zen 1 through Zen 4 processors as affected. AMD assessed the issue as tied to the Linux implementation of Safe RET for the Speculative Return Stack Overflow (SRSO) mitigation rather than the processor architecture alone .
August 6, 2026: The patch shipped in Linux kernel versions 7.1.7, 6.18.43, 6.6.149, and 6.1.181, addressing CVE-2026-68480.
Intel acknowledged the findings during the coordinated disclosure process and awarded a prize from its bug bounty program, but told researchers it would not develop additional mitigations, citing factors such as the availability of disclosure gadgets needed for real-world exploitation .
Implications for CPU Security
TONTOU represents a significant evolution in speculative execution attacks. Unlike earlier Spectre variants that targeted the core prediction mechanism itself, TONTOU attacks the mitigation — the very software and hardware defenses built to stop previous attacks. By identifying a race condition between neutralization and use, the researchers have opened a new class of vulnerability that will require fundamentally different defensive approaches.
The attack also demonstrates that CPU security cannot be solved by software patches alone. While the Linux kernel fix closes the specific interrupt injection window on AMD Zen processors, the underlying architectural assumption — that predictor sanitization and predictor usage can be treated as an atomic operation — has been proven false.
webpronews.comMIT's TONTOU Attack Pierces Spectre Shields on Intel and AMD Processors
people.csail.mit.eduTONTOU: On the Exploitability of Time-of ... - People | MIT CSAIL
bleepingcomputer.comNew TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes
cyberworldops.euTONTOU aggira le difese Spectre v2 e rivela rischio fuga dati kernel