Researchers bypass Spectre v2 mitigations

Researchers at the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) have discovered a method to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks, developing an exploit that can leak sensitive data from Linux machines. The technique targets defenses on AMD and Intel processors that rely on neutralizing or isolating branch predictors. This vulnerability, also known as Branch Target Injection (BTI), exploits a processor's indirect branch predictor to cause mispredictions and speculative execution along an attacker-influenced code path, based on information published by Bleeping Computer.

The attack exploits a time-of-neutralization to time-of-use (TONTOU) window in Spectre v2 defenses, where a gap exists between when the branch predictor is isolated and when it is used. Researchers developed an interrupt injection technique, allowing unprivileged user programs to schedule timer interrupts during kernel execution. This redirects the kernel to an interrupt handler, which can then be used to "re-poison" the CPU's state after neutralization but before it's used. Tested on an AMD Zen 2 system running Linux, the attack successfully leaked arbitrary kernel memory, including password hashes from the /etc/shadow file, at a rate of 5.47 bytes/s with 91.97% accuracy.

While also possible on Intel processors, the attack is more complex due to additional software requirements. AMD has acknowledged the issue, noting its association with the implementation of the Safe RET mitigation on Linux.

Source: Bleeping Computer