MIT’s new “TONTOU” attack exploits a tiny gap in chip defenses on Intel and AMD CPUs, successfully stealing a Linux system’s password file.
Modern processors are fast partly because they guess. Rather than waiting to see which way a program will branch, a chip predicts the likely path and races ahead. When it’s wrong, the work gets discarded — but traces of it can linger.
That’s the same flaw behind Spectre, the chip vulnerability disclosed back in 2018. Chipmakers have spent years building defenses since then. A new MIT study shows a key assumption behind many of those defenses doesn’t actually hold.
The Gap Between Wiping and Using
Chip defenses work by wiping or isolating a processor’s prediction machinery, clearing out anything an attacker might have planted. The problem, according to MIT PhD student Daniël Trujillo and assistant professor Mengjia Yan, is timing.
The wipe and the moment predictions actually get used can’t happen at the exact same instant. There’s always a gap — sometimes just a handful of instructions wide. Anything that runs during that gap can dirty the machinery all over again. The researchers call this class of attack “TONTOU.”
“Interrupt Injection”: Timing the Gap Precisely
The team’s real contribution is a reliable way to land code inside that tiny gap. Computers constantly pause to handle interrupts — small routine tasks triggered by timers, network traffic, or other hardware. Ordinary programs can set those timers themselves.
By tuning a timer with enough precision, Trujillo and Yan made the processor take its detour at exactly the wrong moment. They call this technique “interrupt injection.”
It Worked on Four Chip Generations, Including AMD’s Toughest Defense
The team tested four processor generations from Intel and AMD, and got mispredictions on both. On Intel chips, the attack defeated two separate protections — one built in software for older chips, one built into the silicon of newer ones.
Curiously, the newer silicon-level protection held firm on one Intel generation and failed on another, suggesting chipmakers implement the same nominal defense in meaningfully different ways.
AMD’s defense, called “saferet,” cleans the prediction machinery immediately before each use — leaving a window just two instructions wide, typically executing within tens of nanoseconds. The researchers hit it anyway, by deliberately slowing the processor down at that exact spot.
From a Bad Guess to a Stolen Password File
To show what this means in practice, the team built a working exploit on an AMD system running a current Linux kernel.
They first stripped away a defense that scrambles where the operating system sits in memory — succeeding in all 10 tries, taking about nine minutes each. That let them read protected memory at roughly five bytes per second.
Slow, but fast enough. In half of their attempts, that was enough to locate and copy “/etc/shadow” — the file storing a Linux system’s root password hash.
Fixing It Is Trickier Than It Sounds
The paper suggests cleaning the prediction machinery a second time, right when the interrupt finishes. That looks workable on AMD.
On Intel, it might backfire. Because the attack relies on the interrupt leaving behind a consistent state — rather than any particular one — the standard fix could make the attack more reliable, not less. Newer Intel chips include a dedicated instruction that appears to help instead.
The other option, blocking interrupts entirely during the vulnerable window, would likely cost too much performance to be practical.
Already Disclosed, Already Being Patched
This wasn’t dropped without warning. Trujillo and Yan notified AMD and Intel in early February and reached Linux kernel maintainers in March, coordinating with AMD to warn cloud providers and other downstream customers.
AMD has since released a patch that mitigates the attack, available through a standard operating system update. The researchers’ code is publicly available, and the work was presented this month at both Black Hat USA and USENIX Security.
The research was supported in part by the U.S. Air Force Office of Scientific Research and ACE, one of seven centers in JUMP 2.0, a DARPA-sponsored program.