New Interrupt Injection Attack Bypasses Spectre v2 Defenses on Intel and AMD CPUs
What Happened — Researchers at MIT CSAIL disclosed a novel “interrupt injection” technique that lets an unprivileged Linux process time a hardware interrupt to land between the CPU’s branch‑predictor sanitization and the kernel’s use of that predictor. The method re‑poisons the branch predictor after Spectre v2 mitigations have run, effectively bypassing all default Spectre v2 defenses on both Intel and AMD Zen 2 CPUs running Linux 6.14.
Why It Matters for Compliance & Audit Readiness
- The attack demonstrates a control gap: hardware‑level mitigations that are part of your security control set can be subverted, undermining the SOC 2 CC6.1 “Logical Access Controls” and CC6.2 “System Operations” criteria.
- Continuous evidence collection and control mapping are required to prove that mitigations remain effective after firmware or OS updates—exactly the data Verisq’s Control Mapping capability can capture for audit purposes.
- Demonstrating due‑diligence on hardware‑risk management satisfies the SOC 2 “Risk Management” principle and provides defensible audit artifacts if a regulator or customer asks for proof.
Who Is Affected — Cloud service providers, SaaS platforms, financial institutions, and any organization that runs workloads on Intel or AMD CPUs with Spectre v2 mitigations enabled.
Recommended Actions
- Inventory all servers and identify CPU models and firmware versions.
- Verify that the latest microcode and kernel patches addressing interrupt‑injection have been applied; track this evidence in your control repository.
- Map the hardware‑risk mitigation to SOC 2 CC6.1/CC6.2 controls and collect continuous compliance evidence (e.g., patch‑status reports, automated verification scripts).
- Incorporate the new technique into your threat‑model and update incident‑response playbooks to include hardware‑level exploitation scenarios.
Source: The Hacker News
Technical Notes — The technique exploits timing of hardware interrupts to re‑poison the branch predictor after the kernel’s Spectre v2 mitigation runs. No CVE has been assigned yet; the attack works on both Intel and AMD Zen 2 CPUs under Linux 6.14 with default mitigations enabled.