[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcwxeIBgUVc-VRIrkTpWxn_nzLjLV7uOvLbS9ULRbpkU":3},{"article":4,"iocs":55,"watch_terms":67,"solutions":68,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"da2b2621-18a3-48e1-a5c9-e3d17c1d32ab","New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes","new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes-e04150","Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines. [...]","Researchers have discovered a new CPU attack named TONTOU that bypasses existing Spectre v2 mitigations on both Intel and AMD processors. The attack exploits a time-of-neutralization to time-of-use window to re-poison the CPU's branch predictor, allowing unprivileged code to leak sensitive data, including hashed passwords from Linux systems.","New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F03\u002F18\u002FCPU_attack.jpg","2026-08-06T18:03:45+00:00","2026-08-06T20:00:21.017254+00:00",9,[17,20,23,25,28,30],{"name":18,"type":19},"Linux","product",{"name":21,"type":22},"AMD","vendor",{"name":24,"type":22},"Intel",{"name":26,"type":27},"Spectre v2","technology",{"name":29,"type":27},"Branch Target Injection",{"name":31,"type":19},"Zen 2","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,64],{"type":57,"value":58,"context":59},"malware","TONTOU","Name of the CPU attack technique",{"type":61,"value":62,"context":63},"mitre_attack","T1071.001","Likely related to Application Layer Protocol: Web Protocols (for interrupt injection)",{"type":61,"value":65,"context":66},"T1055","Process Injection (for interrupt injection)",[21,24,18],{"controls":69,"vendors":150},[70,99,128],{"slug":71,"name":72,"problem":73,"products":74},"patch-management","Automated patch management","Known holes get closed in days, not months.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":100,"name":101,"problem":102,"products":103},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":129,"name":130,"problem":131,"products":132},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[133,134,142],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":168},"tontou-cpu-attack-bypasses-spectre-v2-mitigations-exposing-kernel-secrets","TONTOU CPU Attack Bypasses Spectre v2 Mitigations, Exposing Kernel Secrets","The TONTOU attack exploits a race condition between the neutralization and use of the CPU's branch predictor, effectively invalidating existing Spectre v2 mitigations on Intel and AMD processors. This allows unprivileged local users to leak sensitive kernel memory, including hashed Linux passwords, without requiring elevated privileges. The root issue lies in an incomplete understanding of the threat model during mitigation design — patching a vulnerability without accounting for timing-based re-exploitation windows. This matters because hardware-level vulnerabilities are extremely difficult to remediate fully, often requiring microcode updates, OS patches, or performance-costly mitigations. Organizations relying on the assumption that Spectre v2 is 'fixed' now face renewed exposure on unpatched or legacy systems.",[156,157,158,159,160,161,162,163,164,165,166,167],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 SC-39: Process Isolation","MITRE ATT&CK T1212: Exploitation for Credential Access","MITRE ATT&CK T1203: Exploitation for Client Execution","ISO\u002FIEC 27001:2022 A.8.8: Management of Technical Vulnerabilities","ITIL 4: Change Enablement \u002F Vulnerability Management Practice",{}]