Protections built into modern computers can let an attack through for an extremely brief interval.
Researchers at MIT have shown that a malicious program can exploit this instant to bypass defenses against Spectre, a family of flaws affecting the inner workings of processors. The problem concerns Intel and AMD chips tested by the team.
To understand why, a processor regularly tries to guess the next instructions it will have to execute. This anticipation speeds up calculations. If the prediction is wrong, the result is normally discarded. Yet attacks such as Spectre exploit traces left by these provisional operations to indirectly recover information that should have remained inaccessible.
Manufacturers have therefore added several protections. Some clean up or isolate the mechanisms used for these predictions. The exploit specifically targets the very short delay between this cleanup and the moment when the processor actually uses the protected mechanism. A few instructions may be enough.
Daniël Trujillo and Mengjia Yan, from MIT's CSAIL laboratory, have named this family of attacks TONTOU. The attacker seeks to act within a brief window to put the processor back into a state favorable to an information leak.
The experiments covered several generations of Intel and AMD processors.
Protections against Spectre have accumulated since this family of flaws was revealed in 2018. They rely on the operating system, software, and the processor itself. TONTOU shows that it is also necessary to examine what happens between two protection steps, even when each one works as expected on its own.
The researchers shared their findings with the manufacturers concerned before their public presentation. AMD has notably made a corrective measure available for affected systems.