Researchers from the Massachusetts Institute of Technology have identified a new TONTOU (Time-of-Neutralization to Time-of-Use) attack technique for exploiting microarchitectural vulnerabilities of the Specter v2 class. This vulnerability allows for determining the contents of kernel memory when executing an exploit in user space. The code for blocking exploitation of the vulnerability has been added into the Linux kernel and is now included in releases 7.1.7, 6.18.43, 6.12.102, 6.6.149, 6.1.181, 5.15.214, and 5.10.263.
The researchers have demonstrated the ability for a local unprivileged user to launch an attack to determine the hash of the root user’s password, stored in the /etc/shadow file and loaded into memory during system authentication. The data leak from kernel memory showed a performance of 5.47 bytes per second and an accuracy of 91.97%. In half of the 10 test runs, which lasted an average of 18 minutes, the /etc/shadow file presence in memory could be successfully determined and its contents extracted.
The exploit was showcased on systems with AMD processors and can be utilized with AMD CPUs of the Zen families 1-4. Although the attack is also possible on Intel systems, its exploitation is more intricate. AMD processors protect against stack overflow of return addresses and the SRSO (Speculative Return Stack Overflow) vulnerability using the Safe-RET protection mechanism, which narrows the attack window significantly.
To overcome the protection and widen the attack window, a technique was employed to slow down the CPU, allowing for interrupt substitution at the opportune moment. By causing the branch predictor to issue a high number of incorrectly predicted CALLs speculatively, overflow of the return address stack occurs, enabling the alteration of the stack’s initial elements with chosen values by the attacker. This altered data can then be used during speculative execution of the RET instruction in the context of another