MIT researchers unveil TONTOU attack that sidesteps Spectre defenses on Intel and AMD chips

Two MIT scientists demonstrated a new speculative-execution exploit, called TONTOU, that uses precise timer interrupts to re-poison branch predictors after mitigation steps on modern Intel and AMD CPUs.

At DEF CON 34, MIT researchers Daniël Trujillo and Mengjia Yan introduced a novel speculative-execution attack named TONTOU, which exploits the interval between branch-predictor neutralisation and its actual use. By scheduling rapid timer interrupts, they can insert malicious code that re-poisons structures such as the return-stack buffer, defeating defenses like Intel’s eIBRS and AMD’s Safe RET. Their experiments succeeded on Intel Cascade Lake Refresh and Arrow Lake CPUs as well as AMD Zen 2 and Zen 4 chips, with a complete exploit demonstrated on Zen 2 that broke Linux’s KASLR and extracted the /etc/shadow password hash in half of ten trials.

Each run took roughly 18 minutes, and the attack assumes only a stock Linux kernel with default mitigations. The team warned that shared-kernel environments, such as container platforms, could be vulnerable. Intel responded that further mitigations are unlikely, offering only a modest bug-bounty reward, while AMD committed to kernel-level patches; Arm classified the technique as passive leakage not covered by its protections.