MIT boffins’ TONTOU attack slips through Spectre defenses on Intel and AMD CPUs
MIT researchers have developed TONTOU, a speculative-execution attack that can bypass some Spectre v2 defences on Intel and AMD processors. It matters because it challenges the assumption that branch-predictor state remains safe between a system’s protective sanitisation step and the later execution of sensitive code.
The technique uses carefully timed timer interrupts to re-poison branch-prediction structures after they have been neutralised, potentially steering privileged code towards data-leaking speculative paths. Tests succeeded on Intel Cascade Lake Refresh and Arrow Lake, plus AMD Zen 2 and Zen 4 systems; however, a complete exploit was demonstrated only on Zen 2, took roughly 18 minutes per attempt, and remains difficult to execute in practice.
- Timed interrupts can undermine some Spectre v2 protections.
- The attack affected tested Intel and AMD Linux systems.
- Exploitation is slow and technically demanding.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Proponents of this research argue it exposes a fundamental flaw in current Spectre v2 mitigations, namely the false assumption that branch-predictor state remains secure between sanitisation and execution. Even though present exploitation is impractical and slow, this demonstrates that existing defences have architectural gaps which sophisticated attackers might eventually overcome; researchers have a responsibility to highlight such vulnerabilities to drive genuine improvements across the industry rather than allow false confidence in current protections.
The case against
Sceptics contend the practical significance is vastly overstated by sensational framing: the attack takes 18 minutes per attempt, only reliably exploits older AMD processors, and remains extremely difficult to execute in real conditions. Spectre mitigations have already substantially reduced real-world exploitation since their initial discovery, and treating every laboratory edge case as urgent diverts resources from verified, actionable threats; this appears to be incremental academic research on known attack families rather than a breakthrough requiring immediate concern.