Two MIT researchers have developed a new speculative execution attack that uses precisely timed interrupts to slip past defenses against Spectre v2 on both Intel and AMD processors, according to a paper they'll present at DEF CON 34. Daniël Trujillo and Mengjia Yan of MIT's Computer Science and Artificial Intelligence Laboratory demonstrated that attackers can re-poison the branch predictor during what's called the "post-neutralization window" — the brief period between when a processor clears potentially hostile predictor states and when sensitive code actually runs. The attack targets safeguards designed to isolate or clear branch predictor information before protected branches execute, exploiting a shared assumption across different chipmakers' mitigations.

The researchers tested their attack, which they call TONTOU (Time-of-Neutralization to Time-of-Use), on Intel Cascade Lake Refresh and Arrow Lake processors as well as AMD Zen 2 and Zen 4 chips running stock Linux systems with all default protections enabled. They built a complete end-to-end exploit only for Zen 2, since the Intel version requires specific software conditions. Each full attack attempt took roughly 18 minutes to complete. Across ten total runs on Zen 2, the researchers broke Linux's kernel address space layout randomization (KASLR) every single time, though they successfully located and leaked the contents of etc/shadow — which contains the root password hash — in only five of those attempts.

The attack works by scheduling high-frequency timer interrupts from an unprivileged program, hoping one lands during the typically tiny post-neutralization window. "Our demonstration does not assume anything special from the system: we use a stock Linux kernel version, no inserted modules, and all default mitigations," Trujillo told The Register. "Any time you'd execute unprivileged code with timer availability on a system while sharing the kernel with a victim, this attack would be an issue." When an interrupt fires during that window, it allows the interrupt handler to re-poison predictor structures like the return stack buffer or branch history buffer after sanitization but before the victim branch executes, causing a protected branch to speculatively jump to a disclosure gadget that leaks kernel data through a side channel.

The researchers hope their work will spark further investigation into interrupt injections and TONTOU attacks and help build stronger defenses against Spectre-style exploits. They contacted Intel, Arm, and AMD after gathering their results, but only AMD committed to addressing the issue through kernel patches. Intel declined to develop additional mitigations, saying real-world exploits depend on too many variables like the availability of disclosure gadgets, though it did award a bug bounty prize in the hundreds of dollars. Arm stated that TONTOU's interrupt injections fall under "passive leakage," which it doesn't "actively protect against." Multi-tenant container platforms where ordinary user space programs share a kernel would be vulnerable to memory leaks under these conditions. The real-world risk remains limited compared to threats like ransomware, but the attack demonstrates that even hardened systems can harbor exploitable windows when timing precision meets patient adversaries. Organizations running shared-kernel environments may need to weigh the overhead of stronger isolation against the difficulty—though not impossibility—of a motivated attacker threading this particular needle.