MIT researchers Daniël Trujillo and Mengjia Yan presented a new speculative execution technique named TONTOU at DEF CON 34, showing that precisely timed timer interrupts can re‑poison branch predictor structures after Spectre mitigations have been applied. The attack targets the post‑neutralization window, the period between a mitigation’s sanitization of the predictor and the victim branch’s use of the predictor. By injecting interrupts during this window, the researchers were able to alter the return stack buffer or branch history buffer, causing a protected branch to speculatively jump to a disclosure gadget that leaks kernel data.

The team tested the method on Intel Cascade Lake Refresh, Arrow Lake, AMD Zen 2 and Zen 4 processors running Linux. An end‑to‑end exploit was fully functional on AMD Zen 2; Intel exploitation required additional software conditions. Each attempt took roughly 18 minutes, and a sped‑up video of the attack is available online. Across ten trials the attack broke kernel address space layout randomization each time and successfully leaked the contents of /etc/shadow in five cases.

The researchers disclosed their findings to Intel, Arm and AMD. AMD committed to addressing the issue through kernel patches, while Intel said it would not develop additional mitigations because real‑world exploitation depends on many factors and awarded a bug bounty prize. Arm described the interrupt injections as passive leakage and does not currently provide active protection.

The work highlights the practicality of interrupt‑based attacks on modern CPUs and is expected to guide future mitigation development.