Ethical Hacking News
Researchers have discovered a novel attack that can bypass Spectre v2 defenses on Intel and AMD CPUs by exploiting a critical weakness in interrupt handling mechanisms. The vulnerability, dubbed "Interrupt Injection," allows an unprivileged Linux program to leak arbitrary kernel memory and potentially read sensitive information from the system's password hashes.
The researchers at MIT CSAIL have discovered a novel attack on CPU security called "Interrupt Injection" that targets Spectre v2 defense mechanism. The Spectre v2 mitigation is vulnerable to an exploit that allows unprivileged Linux programs to bypass defenses on Intel and AMD CPUs. The attack exploits a critical weakness in the interrupt handling mechanism, allowing malicious instructions to be injected into the CPU's pipeline. The vulnerability was demonstrated on an AMD Zen 2 machine with high accuracy, successfully reading system password hashes from the /etc/shadow file. AMD has published a bulletin detailing the issue and its impact on affected processors, while the Linux kernel has been patched to address the vulnerability.
A recent discovery by researchers at MIT CSAIL has brought to light a novel attack on CPU security, specifically targeting the Spectre v2 defense mechanism. The newly identified vulnerability, dubbed "Interrupt Injection," allows an unprivileged Linux program to bypass the Spectre v2 defenses on Intel and AMD CPUs.
The Spectre v2 mitigation is designed to prevent side-channel attacks by sanitizing or isolating branch predictor state in the CPU. However, this attack exploits a critical weakness in the interrupt handling mechanism, which can be manipulated to re-poison the branch predictor after the defense has run. By doing so, the attacker can inject malicious instructions into the CPU's pipeline, potentially leading to information disclosure.
The researchers, Daniël Trujillo and Mengjia Yan, demonstrated the vulnerability on an AMD Zen 2 machine running Linux 6.14 with every default Spectre v2 mitigation enabled. Their exploit leaked arbitrary kernel memory at a rate of 5.47 bytes per second with an accuracy of 91.97%. Moreover, they successfully read the system's password hashes from the /etc/shadow file in five out of ten attempts.
The researchers attributed the success to the fact that interrupt handling can execute between neutralization and use, breaking the assumption made by the Spectre v2 defense mechanism. They exploited this window by evicting bytes from L1 and L2 cache using a sibling hyperthread, slowing them down, and by picking the write syscall, which left them controlling two registers.
The attack was further demonstrated on an Intel Arrow Lake machine, where the researchers achieved a success rate of 0.22%. However, the authors of the Spectre v2 defense mechanism, Intel, do not consider mitigation necessary, stating that the exploitability depends on many factors and is covered by existing guidance.
In response to this vulnerability, AMD has published a bulletin detailing the issue and its impact on affected processors. The Linux kernel has also been patched to address the vulnerability, with the fix being included in the commit "x86/bugs: Make Safe-RET robust against interrupt injection" dated June 2.
This discovery highlights the ongoing cat-and-mouse game between attackers and defenders in the realm of CPU security. As the landscape evolves, it is essential for organizations to stay vigilant and apply patches to protect themselves from such vulnerabilities. Furthermore, this incident underscores the need for continued research into side-channel attacks and their mitigation strategies.
Related Information:
https://www.ethicalhackingnews.com/articles/New-Breakthrough-in-CPU-Security-Researchers-Unveil-a-Novel-Attack-that-Can-Bypass-Spectre-v2-Defenses-ehn.shtml
https://thehackernews.com/2026/08/new-interrupt-injection-attack-can.html
Published: Thu Aug 6 14:18:46 2026 by llama3.2 3B Q4_K_M
