Researchers at MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) have found a new processor attack that can bypass some defenses against speculative-execution attacks. The technique takes advantage of a tiny timing gap in modern CPUs and could allow attackers to access protected information under certain conditions.
The attack was developed by Daniël Trujillo and Mengjia Yan. They tested the technique on four processor generations from Intel and AMD, finding that it could trigger incorrect CPU predictions and bypass some existing protections.
Modern processors try to predict what instructions a program will need next. This makes computers faster, but researchers have shown that these predictions can also leave behind information that attackers may use to learn data from protected areas of memory.
READ ALSO: https://modernmechanics24.com/post/scientists-unveil-600-new-cancer-tissue/
Chipmakers have added defenses that clear or isolate this prediction information before it can be used. The MIT researchers found that these defenses do not always remove the problem completely because clearing the processor and using its predictions cannot happen at exactly the same time.
The researchers call this attack class TONTOU, while the technique used to trigger the vulnerable timing window is called INTERRUPT INJECTION. It takes advantage of routine processor interrupts, which are events that temporarily pause normal work to handle tasks such as timers or hardware activity.
The team tested the approach on both Intel and AMD processors. On Intel systems, it bypassed two different protections in some tests, while another Intel processor generation resisted the attack, showing that similar security features can behave differently across chip designs.
The researchers also tested AMD’s saferet protection. It clears prediction-related information immediately before use, leaving only a very small window for an attack. The team found a way to make that window easier to target.
To demonstrate the possible impact, the researchers built an exploit on an AMD system running a current Linux kernel. Their test eventually allowed them to read protected system information, showing that the technique was more than a theoretical CPU weakness.
The attack has important limits. The researchers needed precise timing and several steps to reach protected information, and the data could be recovered only at a very slow rate. This means the technique is not a simple remote attack that automatically exposes passwords on every vulnerable computer.
WATCH ALSO: https://modernmechanics24.com/post/wing-expands-walmart-drone-delivery/
The researchers reported the issue to AMD and Intel in February and contacted Linux kernel maintainers in March. AMD has since released a software update that helps mitigate the attack, so keeping operating systems and security updates current is an important defense.
The research matters because it shows that CPU security protections can have weaknesses not visible from their basic design. It also highlights the difficulty of securing speculative execution, where even extremely short timing gaps can create new attack paths.
