MIT boffins’ TONTOU attack slips through Spectre defenses on Intel and AMD CPUs

security

Timer interrupts reopen branch predictor poisoning window, with a working Zen 2 exploit to prove it

Two MIT researchers will present a new speculative execution attack at DEF CON 34 that uses precisely timed interrupts to bypass defenses against Spectre v2.

Daniël Trujillo and Mengjia Yan of MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) shared their paper [PDF] with The Register ahead of publication. Their attack targets mitigations designed to neutralize potentially hostile branch predictor states before sensitive code runs.

Such neutralization is an important defense against Spectre-style attacks. Depending on the mitigation, the processor or operating system isolates, clears, or safely retrains relevant predictor state when entering privileged code or shortly before a protected branch executes.

Different chipmakers deploy neutralization mitigations slightly differently. Intel’s eIBRS sanitizes branch predictors upon context switch, while AMD’s Safe RET, introduced after the Inception attack Trujillo co-authored in 2023, focuses on the point immediately before a protected branch is executed. Trujillo and Yan refer to these as entry neutralization and in-place neutralization respectively.

Crucially, the two classes share the same underlying assumption that attackers cannot alter branch predictor states within what’s known as a “post-neutralization window” – the period between state neutralization and the branch predictor being used.

The defense here relies on the assumption that everything between the point of neutralization and the usage by a victim branch is safe. Trujillo and Yan’s attack shows how attackers can re-poison the branch predictor during the post-neutralization window.

The researchers call the new class of attack TONTOU, for Time-of-Neutralization to Time-of-Use. They demonstrated that an attacker can exploit the post-neutralization window to re-poison branch predictor state on recent AMD and Intel processors.

To do this, they developed an attack primitive called “interrupt injection.” An unprivileged program schedules high-frequency timer interrupts in the hope that one will land during the often tiny post-neutralization window.

Being able to trigger interrupts during the post-neutralization window allows attackers to divert control flow so that an interrupt handler executes after the sanitization phase and before the victim branch is used. 

The interrupt handler can then re-poison predictor structures such as the return stack buffer (RSB) or branch history buffer (BHB), causing a protected branch to speculatively jump to a disclosure gadget that leaks kernel data through a side channel.

Practical attacks

The researchers said that their tests showed the TONTOU attacks worked on both Intel and AMD-based Linux systems.

They tested TONTOU on Intel Cascade Lake Refresh and Arrow Lake processors and AMD Zen 2 and Zen 4 chips. The researchers built a complete end-to-end exploit only for Zen 2, largely because the Intel attack requires specific software conditions.

Speculative side-channel attacks remain difficult to pull off, and you’re more likely to fall victim to ransomware than Spectre in the real world.

Another serious caveat is that each end-to-end attempt took about 18 minutes, and you can see a sped-up version via the video Trujillo posted to YouTube.

Trujillo and Yan identified the exact point at which they needed to inject their interruptions to poison the RSB, and through a series of attacks broke Linux’s kernel address space layout randomization (KASLR), which allowed them to locate specific secrets such as etc/shadow, which contains the root password hash.

Across ten total runs, the researchers were able to break KASLR every time, although they were only able to successfully locate and leak the contents of etc/shadow in five of these.

“It’s definitely not a simple attack, but we show that it’s practical with our end-to-end exploit on AMD Zen 2,” Trujillo told The Register. 

“Our demonstration does not assume anything special from the system: we use a stock Linux kernel version, no inserted modules, and all default mitigations. Any time you’d execute unprivileged code with timer availability on a system while sharing the kernel with a victim, this attack would be an issue.

“For example, multi-tenant container platforms would fall in this category, allowing ordinary user space programs to leak memory from the shared kernel.”

The researchers hope that their work will inspire further investigations into interrupt injections and TONTOU attacks, and to help develop more robust mitigations against Spectre-style exploits.

They engaged Intel, Arm, and AMD after gathering their results, but only the latter committed to address the issue via kernel patches.

Intel told the pair that it won’t be working up any other mitigations since real-world exploits are subject to too many factors, such as the availability of disclosure gadgets, although it awarded a prize from its bug bounty program in the hundreds of dollars.

Arm said TONTOU’s interrupt injections fall under “passive leakage,” which it does not “actively protect against.” ®