TONTOU Exploits a Timing Gap in Spectre Mitigations

Spectre attacks exploit a feature built into virtually every modern processor: prediction. A processor tries to anticipate which instruction comes next because doing so saves time. If its prediction is wrong, it can discard the speculative work and continue down the correct path. But an attacker can manipulate that prediction, Daniël Trujillo explains, so code on the wrong path reads a secret and communicates it through a side channel before the processor rolls the work back.

The secret may be a password, cryptographic key, or other data held by the machine. Because the read happens during a misprediction that is subsequently undone, Trujillo says, there is virtually no evidence that the secret was accessed.

That distinguishes Spectre from a typical software vulnerability. The vulnerability arises from processor behavior rather than an error in application code that can be addressed with an update. Chipmakers have therefore developed mitigations intended to neutralize bad predictions before those predictions can be used to execute another instruction.

TONTOU, short for “Time Of Neutralization, Time Of Use,” exploits the remaining interval between those two events. A mitigation has neutralized an incorrect prediction, but there is still a small window before the processor prevents that prediction from affecting what happens next.

The challenge is timing. Identifying a narrow hardware window in principle does not establish that an attacker can reliably intervene in it on a real processor. Mengjia Yan recalls her initial response to Trujillo’s idea as clever but uncertain. The window was “super small,” she says, and the team did not know whether it could precisely control the event required to reach it.

The event the researchers chose was an interrupt: a normal processor mechanism through which devices and system activity ask the CPU for attention. Eduardo Vela describes interrupts as constantly occurring signals associated with inputs such as keystrokes, a hard drive, camera, microphone, or other devices writing information to memory. The CPU pauses to inspect the request, acts if it matters, or returns to its prior work.

That routine behavior provides the primitive for the attack. Trujillo’s question was whether an interrupt could occur exactly during the TONTOU gap. The researchers set a timer to generate an interrupt at a carefully selected moment. They then made the relevant processor work slower by evicting instructions from the cache, forcing the machine to retrieve them from farther-away memory. That delay expands the window enough, they found, to make an interrupt landing in it possible.

The interrupt lets the attack poison the processor’s predictor after it has been neutralized but before it is used. The result is a new misprediction, which creates the same kind of speculative path Spectre exploits to access information it should not be able to read.

Trujillo says the team ran the timer technique tens of thousands of times and succeeded two percent of the time. Vela’s broader point is that the rate need not be high to matter: a protection intended to permit no such event has failed once an attacker can make it happen at all.

The end-to-end demonstration targeted /etc/shadow, which Daniël Trujillo calls one of the system’s most sensitive files. The attack terminal shown in the research reports /etc/shadow found: 0x1290b3000; a subsequent terminal display shows leaked credentials including an entry for root.

The file contains password hashes, including hashes associated with root or administrator users. A successful leak of /etc/shadow, the source says, means the system is no longer secure for every user on that machine.

Trujillo also points to the implications for cloud servers. If vulnerable server hardware supports multiple users, he says, one attack can make multiple users victims at once. The concern is not a claim that every cloud service exposes the same data, but that multiple users may rely on the same vulnerable server hardware.

After achieving the attack, the researchers disclosed their technique to AMD. Trujillo says AMD asked for the code so it could reproduce the result and determine a mitigation. An AMD security bulletin shown in the source identifies a “Safe RET Interrupt Vulnerability” affecting AMD “Zen” architecture processors and acknowledges Trujillo for reporting and participating in coordinated vulnerability disclosure.

For Eduardo Vela, that disclosure process is central to the result: academic research makes it possible for the wider world to learn about a problem that might otherwise remain confined to the systems in which it was found. Trujillo says the work will be presented at Black Hat USA and USENIX Security as the team continues research on processor vulnerabilities at MIT CSAIL.