{"id":182817,"date":"2026-08-10T19:49:35","date_gmt":"2026-08-10T17:49:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2"},"modified":"2026-08-10T19:49:35","modified_gmt":"2026-08-10T17:49:35","slug":"tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/tontou-ataka-na-cpu-intel-i-amd-pozvolyayushhaya-obojti-zashhitu-ot-uyazvimostej-spectre-v2","title":{"rendered":"TONTOU \u2014 an attack on Intel and AMD CPUs that allows bypassing the protection against Spectre v2 vulnerabilities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from the Massachusetts Institute of Technology have identified the TONTOU (Time-of-Neutralization to Time-of-Use) attack technique, which offers a new way to exploit microarchitectural vulnerabilities of the Spectre v2 class. The vulnerability allows for the determination of the kernel memory contents while executing the exploit in user space. Code to block the exploitation of this vulnerability was integrated into the Linux kernel on August 5 and included in releases 7.1.7, 6.18.43, 6.12.102, 6.6.149, 6.1.181, 5.15.214, and 5.10.263. <\/p>\n
The researchers demonstrated the capability of a local unprivileged user to perform an attack to determine the hash of the root user's password, stored in the \/etc\/shadow file and loaded into memory during system authentication. They achieved data leakage from kernel memory at a rate of 5.47 bytes per second with an accuracy of 91.97%. Out of 10 test runs of the exploit, which averaged 18 minutes, they successfully identified the presence of the \/etc\/shadow file in memory and extracted its contents in half of the cases. <\/p>\n
The exploit has been demonstrated on systems with AMD processors and can be used with AMD CPUs from the Zen 1-4 families. In Intel systems, the attack is also feasible, but exploitation is more complex. To protect against return address stack overflows and block the SRSO (Speculative Return Stack Overflow) vulnerability in AMD processors, a Safe-RET protection mechanism is employed, which clears the branch prediction buffer after each use and narrows the attack window to 2 instructions executed over several tens of nanoseconds. <\/p>\n
To bypass this protection and extend the window for carrying out an attack, a CPU throttling technique has been implemented, allowing for timely execution of the interrupt substitution to redirect the execution flow in the kernel and make use of the interrupt handler to distort the entry in the branch prediction buffer. To exploit the SRSO vulnerability, an attacker can create conditions under which the branch prediction block speculatively performs a large number of incorrectly predicted CALL invocations, sufficient to overflow the return address stack and overwrite correctly predicted return points located at the beginning of the stack. As a result, the initial stack elements can be overwritten with values chosen by the attacker, which will subsequently lead to these substituted values being used during the speculative execution of the RET instruction in the context of another process. <\/p>\n
The processor will determine that the branch prediction was incorrect and will roll back the operation to its original state, but the data processed during speculative execution will remain in the cache and microarchitectural buffers. If the incorrectly executed block accesses memory, then its speculative execution will cause the data read from memory to reside in the general cache. One of the methods for extracting information from the cache may utilize analysis of the change in access time to cached and non-cached data. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"