New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes
New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes.
Researchers have discovered a new CPU attack named TONTOU that bypasses existing Spectre v2 mitigations on both Intel and AMD processors. The attack exploits a time-of-neutralization to time-of-use window to re-poison the CPU's branch predictor, allowing unprivileged code to leak sensitive data, including hashed passwords from Linux systems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AMD?
Get an email when a new story names AMD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe TONTOU attack exploits a race condition between the neutralization and use of the CPU's branch predictor, effectively invalidating existing Spectre v2 mitigations on Intel and AMD processors. This allows unprivileged local users to leak sensitive kernel memory, including hashed Linux passwords, without requiring elevated privileges. The root issue lies in an incomplete understanding of the threat model during mitigation design — patching a vulnerability without accounting for timing-based re-exploitation windows. This matters because hardware-level vulnerabilities are extremely difficult to remediate fully, often requiring microcode updates, OS patches, or performance-costly mitigations. Organizations relying on the assumption that Spectre v2 is 'fixed' now face renewed exposure on unpatched or legacy systems.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — TONTOU
- mitre_attack — T1071.001
- mitre_attack — T1055