Eight years after Spectre upended assumptions about CPU security, a new attack from MIT CSAIL shows the mitigations we built to contain it still have holes. TONTOU, short for time-of-neutralization to time-of-use, bypasses Spectre v2 defenses on AMD and Intel CPUs and has been demonstrated leaking Linux password hashes straight out of kernel memory. It is a reminder that speculative execution attacks are not a solved problem; they are an ongoing one.
What TONTOU actually does
TONTOU is an interrupt injection attack. The core idea is subtle and is best understood against the backdrop of how Spectre v2 mitigations work. When a CPU encounters a branch, it guesses where execution will go and works ahead. Spectre v2, also called branch target injection, exploits the guessing mechanism to steer the CPU into executing code it should not. Defenses like Retpoline and branch predictor neutralization were built to stop that steering by sanitizing the prediction state.
TONTOU finds a gap in that defense. There is a window between when the CPU neutralizes the branch predictor and when the poisoned state is actually cleared from execution. An attacker who can trigger a timer interrupt lands inside that window and re-poisons the branch state before the CPU finishes cleaning up. The result is that the mitigation is bypassed for a tiny slice of time, and that slice is enough to leak data.
The technical naming captures the essence: there is a time-of-neutralization, then a time-of-use, and the attacker exploits the space between them.
The demonstrated impact
The researchers ran the attack against an AMD Zen 2 system and reported a 91.97% accuracy rate at a leak rate of around 5.47 bytes per second. In practical terms they were able to pull the contents of /etc/shadow, the file that holds Linux password hashes. That is the crown jewels for an attacker: a copy of those hashes enables offline brute-force and pass-the-hash style attacks without ever touching a running process or deploying a binary.
A leak rate of five bytes per second does not sound fast, but you do not need speed to be dangerous. A single password hash is a few dozen bytes. The attack just needs the right kernel regions in scope, and given time it can drain them.
Who is affected
The researchers targeted AMD Zen 2 and Intel CPUs that carry Spectre v2 mitigations. The significance is not a single vulnerable generation; it is that the technique targets the mitigation layer itself. Any CPU whose defense relies on branch predictor neutralization is theoretically in scope, which is to say a very large swath of shipped hardware.
An important caveat is the attack prerequisites. TONTOU requires timing that points toward kernel-level control: the interrupt handler manipulation and the ability to land in the vulnerable window. That means the attack typically pairs with kernel privilege escalation or already-compromised execution, or a scenario where the attacker controls a critical enough process. It is not a drive-by that works against an unpatched web browser. But combined with another kernel bug, it becomes a reliable way to turn code execution into data exfiltration.
Why password hash leakage matters
There is a class of security that assumes the kernel is a hard boundary. Processes cannot read each other’s memory, and the OS protects secrets like password hashes behind that boundary. TONTOU erodes the boundary from inside the CPU. It does not need to break file permissions or exploit a kernel driver bug; it reads protected memory through the side channel that speculative execution opened.
Stealing hashes matters for two reasons. First, it enables credential attacks that are hard to detect because nothing in the logs looks abnormal. Second, it feeds the password reuse problem: one leaked hash for a shared or reused password cascades across every system that uses it. This is why researchers keep hammering on speculative side channels even as the exploit code gets more esoteric.
What it says about our mitigations
The uncomfortable lesson of TONTOU is that neutralization-based mitigations have a fundamental blind spot. The defenses assume the branch predictor can be reset to a safe state, and the attack shows that assumption is leaky. As mitigations matured, researchers have kept finding ways around them: this is not the first and will not be the last bypass.
It also underscores that hardware-level security promises made years ago were stronger than what the silicon actually delivered. Teams that assumed “we run a modern kernel with all the Spectre mitigations, so we are safe” need to update that mental model. Mitigations reduce risk; they do not eliminate the class.
What you can actually do
There is no known software mitigation for TONTOU yet, so practical hardening is about the controls around it:
- Assume kernel boundaries are leaky. This is the trigger to move secrets out of the blast radius. Password hashes, API tokens, and encryption keys should not live in places an interrupt-mediated side channel can reach.
- Defense in depth on privilege escalation. TONTOU leans on a prior compromise to work well. Patching kernel bugs, locking down scheduling, and limiting timer-interrupt exposure for sensitive workloads all raise the bar.
- Use stronger hashing and MFA. If hashes do leak, you want them to be slow to crack and useless on their own. This is the classic mitigation: make the leaked artifact not worth stealing.
- Watch vendor advisories. AMD, Intel, and the Linux kernel maintainers will respond to this with microcode or kernel work. Subscribe to the relevant security feeds and plan to apply updates.
The bigger picture
TONTOU is a research demonstration more than an active widespread campaign, but its significance is in what it proves. A decade in, the speculative execution security saga is still producing new bypasses of our best defenses. Every mitigation layer we add is met by a more creative way to step around it.
The practical takeaway for system owners is not despair, it is realism. Keep the fundamentals tight: patch promptly, isolate sensitive data, enforce strong credential hygiene, and stop assuming any single mitigation is a silver bullet. The CPU is a complex, leaky machine, and the people who study it hardest keep finding new cracks.
For security teams, the TONTOU write-up is worth studying precisely because it is the shape of attacks to come, a reminder that the hardware trust boundary has thinner walls than we like to believe.