MIT Researchers Discover New Security Flaw in Intel and AMD CPUs
Dubbed TONTOU, the attack bypasses Spectre defenses to enable data leaks.
1A New Attack Bypassing Spectre Defenses
MIT researchers Daniël Trujillo and Mengjia Yan have developed a new attack method that bypasses Spectre v2 defenses on Intel and AMD processors. Called TONTOU, this attack targets CPUs' speculative execution feature. The researchers demonstrated they could re-poison the branch predictor by injecting interrupts during a critical timing window known as the 'post-neutralization window'.
2The Critical Role of Timing
The TONTOU attack targets the millisecond-wide window between when the CPU's branch predictor is cleared and when it's used. Researchers succeeded in injecting interrupts during this window using high-frequency timer interrupts. This interrupt handler runs before a protected branch, re-poisoning the predictor and potentially leading to kernel data leaks.
3Effective on AMD and Intel Processors
Researchers tested the TONTOU attack on Intel Cascade Lake Refresh, Arrow Lake and AMD Zen 2, Zen 4 processors. They developed a complete exploit specifically for AMD Zen 2. The attack breaks Linux's kernel address space layout randomization (KASLR) protection, allowing location detection of sensitive files like /etc/shadow.
4Challenges in Real-World Conditions
Executing the TONTOU attack is quite challenging. A full exploit attempt takes about 18 minutes with low success rates. However, researchers note the risk is significant in scenarios like multi-tenant container platforms. Attack success depends on factors like system interrupt timing and the presence of disclosure gadgets.
5Vendor Responses
Researchers shared findings with Intel, AMD and Arm. AMD committed to address the issue with kernel patches, while Intel stated real-world exploits depend on too many factors and won't develop additional mitigations. Arm classified such attacks as 'passive leakage' it doesn't actively protect against.
6History of Speculative Execution Vulnerabilities
Spectre-class attacks were first discovered in 2018. Security flaws in CPUs' speculative execution mechanism for performance can lead to sensitive data leaks. While various software and hardware mitigations have been developed since, TONTOU represents a new class of attack that can bypass these defenses.
7Industry Impact
The discovery of TONTOU raises significant security concerns, particularly for cloud computing and multi-tenant systems. Researchers emphasize the need for more comprehensive investigation of interrupt injections and development of more robust defenses. Such attacks necessitate new approaches in hardware security design.
8Importance for Future Security Research
TONTOU represents a new direction in speculative execution attack research. The MIT team's work demonstrates that timing and interrupt mechanisms in processor security design require deeper analysis. These findings could contribute to developing more secure speculative execution mechanisms in future CPU generations.