Researchers from MIT CSAIL have discovered "Interrupt Injection," a sophisticated Time-of-Check to Time-of-Use (TOCTOU) vulnerability that bypasses Spectre v2 mitigations on Intel and AMD CPUs. The attack exploits a critical timing window where an unprivileged user can trigger a hardware interrupt immediately after the branch predictor has been sanitized but before the kernel executes. This allows for the re-poisoning of the branch predictor, enabling speculative execution-based data leakage across privilege boundaries. The discovery exposes fundamental weaknesses in current microarchitectural defense implementations, necessitating immediate kernel-level updates to secure Linux-based systems against cross-privilege information disclosure.

• Overview: The Interrupt Injection Threat
  • Classification: A highly sophisticated Time-of-Check to Time-of-Use (TOCTOU) speculative execution attack.
  • Core Objective: Bypassing established Spectre v2 hardware and software mitigations.
  • Target Platforms: Widely applicable across Intel architectures and AMD Zen 2 microarchitectures.
• Vulnerability Mechanics: Exploiting the Sanitization Gap
  • The Timing Window: Exploits the microsecond gap between branch predictor sanitization and kernel execution.
  • Attack Vector: An unprivileged user triggers precisely timed hardware interrupts to re-poison the branch predictor.
  • Technical Mechanism: Re-injects malicious branch targets during the brief window when the predictor is unprotected.
• Impact: Cross-Privilege Data Leakage
  • Threat Actor Level: Can be executed by an unprivileged user with minimal system access.
  • Security Consequences: Enables unauthorized cross-privilege data leakage via microarchitectural speculative execution.
  • Architectural Risk: Demonstrates that existing speculative execution defenses are fundamentally incomplete.
• Mitigation: Critical Kernel Remediation
  • Immediate Action: Deployment of security-hardened Linux kernel updates.
  • Specific Versions: Remediation is available in Linux kernel 6.18.4, 6.14.9, and 6.11.8.
  • Defensive Priority: High; addresses a core microarchitectural security vulnerability in widespread hardware.
• Conclusion: Future Defensive Outlook
  • Microarchitectural Security: Highlights the persistent difficulty of securing CPU branch predictors.
  • Defense Evolution: Signals a shift toward needing more robust, hardware-integrated sanitization protocols.
  • Industry Urgency: Demands rapid patching cycles for kernel-level vulnerabilities in high-performance computing environments.