TONTOU Attack Shows Spectre v2 Mitigations Can Leak Linux Password Hashes
MIT CSAIL researchers demonstrate a new 'TONTOU' interrupt‑injection technique that sidesteps neutralization‑based Spectre v2 defenses on recent Intel and AMD CPUs. The exploit reads arbitrary kernel memory, including /etc/shadow password hashes, at a measurable rate on AMD Zen 2. It proves current Spectre mitigations are insufficient, forcing OS vendors to rethink speculative‑execution defenses.