--- title: New TONTOU CPU attack bypasses Spectre v2 fixes, leaks... description: Researchers from MIT CSAIL discovered a new CPU attack called TONTOU (Time-of-Neutralization to Time-of-Use) that bypasses existing Spectre v2 mitigations on... canonical: https://daily.dev/posts/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes-lchsqy8rk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes | daily.dev og:description: Researchers from MIT CSAIL discovered a new CPU attack called TONTOU (Time-of-Neutralization to Time-of-Use) that bypasses existing Spectre v2 mitigations on... og:url: https://daily.dev/posts/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes-lchsqy8rk og:image: https://api.daily.dev/og/posts/lcHSQY8rk.png og:image:alt: New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments ## Summary Researchers from MIT CSAIL discovered a new CPU attack called TONTOU (Time-of-Neutralization to Time-of-Use) that bypasses existing Spectre v2 mitigations on AMD and Intel processors. The attack exploits a timing gap between when the branch predictor is neutralized and when it is used, allowing an unprivileged attacker to re-poison the CPU state via interrupt injection. On an AMD Zen 2 system running Linux 6.14.0-37-generic, the attack successfully leaked arbitrary kernel memory at 5.47 bytes/second, including /etc/shadow password hashes, completing in about 18 minutes per attempt with a 50% success rate across 10 runs. AMD has published a security advisory linking the issue to Linux's Safe RET mitigation implementation. Findings were presented at Black Hat USA and will appear at USENIX Security 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the TONTOU CPU attack and how does it bypass Spectre v2 mitigations? TONTOU (Time-of-Neutralization to Time-of-Use) exploits a timing gap in neutralization-based Spectre v2 mitigations on AMD and Intel CPUs. Existing defenses assume an attacker cannot re-poison the branch predictor after it has been sanitized but before it is used. TONTOU uses interrupt injection — scheduling timer interrupts during kernel execution — to re-poison the indirect branch predictor within that post-neutralization window, bypassing mitigations entirely. _Developers and security engineers tracking CPU vulnerability disclosures follow coverage like this on daily.dev._ ### What was the data leak rate and success rate of the TONTOU attack on AMD Zen 2? On an AMD Zen 2 system running Linux 6.14.0-37-generic with 16GB of RAM, the TONTOU attack leaked arbitrary kernel memory at 5.47 bytes per second. Across 10 test runs targeting /etc/shadow (which stores password hashes), the attack succeeded in 5 cases, with each attempt averaging 18 minutes. _Teams hardening Linux systems against speculative execution attacks track new findings like these on daily.dev._ ## Similar posts on daily.dev - [New type of attack can slip past the defenses in your computer’s processor](https://daily.dev/posts/new-type-of-attack-can-slip-past-the-defenses-in-your-computer-s-processor-hhyhhdxyi) · MIT News · 0 upvotes · 0 comments - [Newer RISC-V CPUs Vulnerable To Spectre V1 - Linux Mitigation Patches Posted](https://daily.dev/posts/newer-risc-v-cpus-vulnerable-to-spectre-v1---linux-mitigation-patches-posted-w75vepfxx) · Phoronix · 0 upvotes · 0 comments - [NDSS 2025 – CounterSEVeillance: Performance-Counter Attacks On AMD SEV-SNP](https://daily.dev/posts/ndss-2025-counterseveillance-performance-counter-attacks-on-amd-sev-snp-gqf73tije) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes-lchsqy8rk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes","url":"https://daily.dev/posts/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes-lchsqy8rk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes-lchsqy8rk"},"datePublished":"2026-08-06T18:08:10.591Z","dateModified":"2026-08-07T14:18:43.908Z","description":"Researchers from MIT CSAIL discovered a new CPU attack called TONTOU (Time-of-Neutralization to Time-of-Use) that bypasses existing Spectre v2 mitigations on...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/482cd0066efdc093b7afa5092c6a3903?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/482cd0066efdc093b7afa5092c6a3903?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes-lchsqy8rk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes-lchsqy8rk#faq","mainEntity":[{"@type":"Question","name":"What is the TONTOU CPU attack and how does it bypass Spectre v2 mitigations?","acceptedAnswer":{"@type":"Answer","text":"TONTOU (Time-of-Neutralization to Time-of-Use) exploits a timing gap in neutralization-based Spectre v2 mitigations on AMD and Intel CPUs. Existing defenses assume an attacker cannot re-poison the branch predictor after it has been sanitized but before it is used. TONTOU uses interrupt injection — scheduling timer interrupts during kernel execution — to re-poison the indirect branch predictor within that post-neutralization window, bypassing mitigations entirely. Developers and security engineers tracking CPU vulnerability disclosures follow coverage like this on daily.dev."}},{"@type":"Question","name":"What was the data leak rate and success rate of the TONTOU attack on AMD Zen 2?","acceptedAnswer":{"@type":"Answer","text":"On an AMD Zen 2 system running Linux 6.14.0-37-generic with 16GB of RAM, the TONTOU attack leaked arbitrary kernel memory at 5.47 bytes per second. Across 10 test runs targeting /etc/shadow (which stores password hashes), the attack succeeded in 5 cases, with each attempt averaging 18 minutes. Teams hardening Linux systems against speculative execution attacks track new findings like these on daily.dev."}}]} ```