[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyoCfb7HUnTUhre_PQF7ShSCQt0yr2KV4q35RQrdgllo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":45,"controls":52},"465bd2d4-e557-4063-befc-815c40680372","tontou-cpu-attack-bypasses-spectre-v2-mitigations-exposing-kernel-secrets","da2b2621-18a3-48e1-a5c9-e3d17c1d32ab","TONTOU CPU Attack Bypasses Spectre v2 Mitigations, Exposing Kernel Secrets","The TONTOU attack exploits a race condition between the neutralization and use of the CPU's branch predictor, effectively invalidating existing Spectre v2 mitigations on Intel and AMD processors. This allows unprivileged local users to leak sensitive kernel memory, including hashed Linux passwords, without requiring elevated privileges. The root issue lies in an incomplete understanding of the threat model during mitigation design — patching a vulnerability without accounting for timing-based re-exploitation windows. This matters because hardware-level vulnerabilities are extremely difficult to remediate fully, often requiring microcode updates, OS patches, or performance-costly mitigations. Organizations relying on the assumption that Spectre v2 is 'fixed' now face renewed exposure on unpatched or legacy systems.","**Immediate actions:**\n- Monitor vendor security advisories (Intel, AMD, Linux kernel) for microcode and OS patches addressing TONTOU and apply them as soon as they are released.\n- Restrict local user access on sensitive systems to minimize the pool of users who could execute unprivileged exploit code.\n- Audit systems storing or processing sensitive credentials (e.g., `\u002Fetc\u002Fshadow`) and enforce strict access controls around those assets.\n\n**Long-term improvements:**\n- Maintain a complete, up-to-date hardware and OS inventory to rapidly scope exposure when new CPU-level vulnerabilities are disclosed.\n- Adopt a hardware lifecycle policy that prioritizes replacing end-of-support CPUs that no longer receive microcode updates.\n- Evaluate and deploy kernel hardening options (e.g., IBRS, STIBP, kernel page-table isolation) while accepting and documenting any associated performance trade-offs.\n\n**Detection measures:**\n- Implement runtime security monitoring (e.g., auditd, eBPF-based tools) to detect anomalous access patterns to credential-related files or kernel memory interfaces.\n- Subscribe to vulnerability feeds (NVD, CERT, vendor bulletins) and integrate them into your vulnerability management platform to ensure zero-day CPU disclosures trigger automated alerting.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 SC-39: Process Isolation","MITRE ATT&CK T1212: Exploitation for Credential Access","MITRE ATT&CK T1203: Exploitation for Client Execution","ISO\u002FIEC 27001:2022 A.8.8: Management of Technical Vulnerabilities","ITIL 4: Change Enablement \u002F Vulnerability Management Practice",{},"published","2026-08-06T20:21:14.926247+00:00","2026-08-06T20:21:14.618+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes\u002F","new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes-e04150","New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes",[33,39],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[46],{"id":47,"date":48,"edition":49,"title":50,"audio_url":51},"a53d647d-c82b-48df-a42a-e4ddbd1dd32a","2026-08-07","morning","ThreatNoir Morning Brief — August 7","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-07\u002Fthreatnoir-morning-brief-2026-08-07.mp3",[53,56,60],{"slug":42,"name":54,"problem":55},"Automated patch management","Known holes get closed in days, not months.",{"slug":57,"name":58,"problem":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":61,"name":62,"problem":63},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees."]