Home › Science › MIT Researchers Find Attack That Bypas
SCIENCE

MIT Researchers Find Attack That Bypasses Processor Defenses

Researchers developed an attack called TONTOU that exploits timing gaps in processor prediction defenses to extract Linux root password hashes.

By Xentir Media Newsroom · Editorial standards by Jomon · August 28, 2026 · 2 min read
WHAT YOU NEED TO KNOW
  • MIT researchers developed TONTOU, an attack using interrupt injection to contaminate processor prediction machinery during a split-second gap after a security wipe.
  • The method bypassed defenses across four processor generations from both Intel and AMD.
  • A proof-of-concept exploit on Linux read protected memory at five bytes per second and extracted the root password file in 50 percent of attempts.
  • Trujillo and Yan notified Intel and AMD in February, and AMD released an operating system patch to mitigate the vulnerability.

MIT researchers uncovered a method to bypass computer processor protections by exploiting a timing gap between when prediction machinery is cleaned and when it is used. In a report published by MIT, PhD student Daniël Trujillo and Assistant Professor Mengjia Yan demonstrated the attack class, named TONTOU, against chips from Intel and AMD.

Modern chips predict program branches to increase speed, discarding mistaken work while leaving traces in memory. Chipmakers and operating system developers built mitigations to wipe or isolate prediction mechanisms before execution. Trujillo and Yan discovered that the wipe and the execution cannot happen simultaneously, leaving an exploitable window. Using a technique called interrupt injection, the researchers tuned routine software timers to trigger interrupts precisely inside that gap, recontaminating the prediction machinery.

Testing Intel and AMD hardware

The team tested four processor generations from Intel and AMD, triggering mispredictions on both platforms. On Intel chips, the technique bypassed software protections on older models and hardware defenses built into newer silicon. The hardware protection succeeded on one Intel generation but failed on another. On AMD hardware, the researchers targeted the saferet defense, which leaves an execution window of two instructions lasting tens of nanoseconds, by slowing down the processor at that specific location.

Trujillo and Yan demonstrated the vulnerability on an AMD system running a current Linux kernel. The exploit bypassed operating system memory layout protections in all 10 attempts, averaging nine minutes per run. The process read protected memory at roughly five bytes per second, successfully locating and copying the system's "/etc/shadow" root password file in half of the attempts.

Trujillo and Yan alerted Intel and AMD in early February and reached Linux kernel maintainers in March, coordinating with AMD to notify cloud providers. AMD released a mitigation patch through operating system updates. Supported by the Air Force Office of Scientific Research and the DARPA-sponsored JUMP 2.0 program, the researchers presented their findings at Black Hat USA and USENIX Security.

SOURCES
New type of attack can slip past the defenses in your computer’s processor — MIT
MIT · Engineering
Xentir Media
Xentir Media NewsroomSource-backed AI and technology coverage, drafted by Xentir's automated editorial system under fixed human-set rules. See our editorial policy and AI usage policy.
J
Jomon · Founder & EditorFounder and editor of Xentir Media. Sets the editorial rules the newsroom system runs under, and is accountable for its corrections. About Jomon · [email protected]
The Xentir Brief
The developments worth knowing — one useful email.
Get the Brief →
RELATED ON XENTIRMIT Researchers Map 3D Pore Networks in Metallic Nuclear FuelMIT Researchers Launch Platform to Guide Space Habitat DesignMIT Researchers Publish Economic Framework for Fusion PowerMIT Algorithm Models Extreme Events Without Past Disaster Data