MIT researchers discover TONTOU, a Spectre variant bypassing Intel and AMD CPU defences

Eight years after Spectre shook the foundations of processor security, researchers at MIT have found yet another crack in the defenses that chip makers built to patch the original wound. The new attack, called TONTOU, exploits something almost impossibly small: a gap measured in nanoseconds between the moment a processor neutralizes sensitive information and the moment it actually uses that information. In that sliver of time, an attacker can slip back in and poison the processor's prediction machinery all over again.

Daniël Trujillo and Mengjia Yan, working at MIT's Computer Science and Artificial Intelligence Laboratory, spent months studying how Intel and AMD processors handle branch prediction—the technique that lets chips guess which instructions are coming next and start executing them before they're certain. When a guess is wrong, the processor throws away the results, but traces linger in internal structures. Spectre exploits those traces. Since 2018, chip makers have tried to prevent attackers from tampering with branch prediction before sensitive operations. What Trujillo and Yan discovered is that the defense itself has a flaw: the act of cleaning up the prediction machinery and the act of using it are two separate events, separated by what they call a "post-neutralisation window."

TONTOU stands for Time-of-Neutralization to Time-of-Use. The researchers weaponized it using interrupt injection—a technique that schedules high-frequency timer interrupts to land precisely within that narrow window, allowing them to re-poison structures like the return stack buffer and branch history buffer. They tested the approach on Intel's Cascade Lake Refresh and Arrow Lake chips, and on AMD's Zen 2 and Zen 4 architectures. Both families proved vulnerable. On AMD systems, the window was sometimes only two instructions wide, lasting tens of nanoseconds. Yet they found a way through.

The real proof came when they built a working exploit. On an AMD Zen 2 system running standard Linux, they defeated KASLR—kernel address space layout randomization, a fundamental defense that randomizes where sensitive kernel code lives in memory. They succeeded in all ten attempts. In five of those runs, they extracted the location of /etc/shadow, the file containing password hashes for privileged accounts. This was not theoretical. This was real data leakage from a real system.

But TONTOU is not the kind of attack that will compromise your laptop tomorrow. The researchers measured a data extraction rate of around five bytes per second. A complete exploit could take eighteen minutes. The attack demands significant technical knowledge, precise timing, and a carefully controlled environment. For ordinary desktop users, the risk is negligible. For cloud providers and multi-tenant systems—where untrusted code runs alongside sensitive workloads—the calculus is different.

The researchers disclosed their findings to AMD in February and to Linux kernel maintainers in March. AMD released a kernel patch. Intel, by contrast, told the researchers it has no plans for additional mitigations, citing the number of conditions required to make the attack work. Intel did acknowledge the research with a bug-bounty payment. The divergence in response underscores a deeper truth: Spectre was never a problem with a single fix. It was a revelation about how modern processors work, and the defenses built since have been playing catch-up in a system that was never designed with this kind of threat in mind.

Years after the original disclosure, the underlying vulnerability remains. The challenge is not that processors are broken—they work brilliantly at what they were designed to do. The challenge is that speed and security were never meant to coexist, and every defense creates new surfaces to attack. TONTOU is just the latest proof that the tension between them has not been resolved.