New “TONTOU” CPU Attack Bypasses Spectre v2 Mitigations and Leaks Linux Password Hashes
What Happened — Researchers from MIT’s CSAIL demonstrated a “Time‑of‑Neutralization‑to‑Time‑of‑Use” (TONTOU) side‑channel that defeats the latest Spectre v2 mitigations on AMD Zen 2 and Intel CPUs. By injecting a timer interrupt during a narrow post‑neutralization window, an unprivileged user program can poison the indirect branch predictor and exfiltrate kernel‑level secrets such as Linux password hashes.
Why It Matters for Compliance & Audit Readiness
- The technique exploits a control gap in hardware‑level mitigations that many organizations assume are fully patched – a classic example of why continuous control mapping and evidence collection are essential.
- SOC 2’s CC6.1 – System Operations and CC7.1 – Change Management require documented, repeatable verification that security controls (including CPU‑level mitigations) remain effective after updates.
- Verisq’s Control Mapping capability can automatically map the Spectre v2 mitigation controls to SOC 2 criteria and continuously collect evidence that the mitigations are correctly applied across your fleet.
Who Is Affected – Enterprises running Linux workloads on modern AMD or Intel servers (cloud providers, SaaS platforms, on‑prem data centers).
Recommended Actions
- Review your hardware‑level security controls and verify that the latest microcode and kernel patches are deployed.
- Map the Spectre v2 mitigation controls to SOC 2 requirements and enable continuous evidence collection to prove their effectiveness.
- Conduct a focused control‑gap assessment for speculative‑execution mitigations and document any residual risk. Source: BleepingComputer
Technical Notes – The attack leverages the “neutralization‑based” mitigations (eIBRS on Intel, Safe RET on AMD) and a narrow timing window between predictor sanitization and use. No CVE has been assigned yet; the researchers released proof‑of‑concept code that runs from an unprivileged user context and extracts password hashes via speculative execution. Source: BleepingComputer