Researchers from MIT have demonstrated the TONTOU attack, which exploits timer interrupts to reopen branch predictor poisoning windows on both Intel and AMD processors. The study provides a working exploit targeting Zen 2 architecture, showing that existing Spectre mitigations can be circumvented by leveraging interrupt timing. This finding challenges the current efficacy of standard hardware-level countermeasures against side-channel attacks.
- Timer interrupts can reset branch predictor states, enabling new Spectre variants.
- Both Intel and AMD CPUs are vulnerable to this specific branch predictor poisoning method.
- A functional exploit for Zen 2 proves the theoretical vulnerability is practical.
- Existing Spectre mitigations may be insufficient against interrupt-timing attacks.
- Firmware and kernel updates may need to address interrupt handling security.
