Researchers at MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) have identified a new Linux vulnerability, dubbed INTERRUPT INJECT, that can bypass Spectre v2 defenses on Intel and AMD CPUs.
The vulnerability, discovered by Daniël Trujillo and Mengjia Yan, exploits a timing attack on the branch predictor, a component of the CPU's execution pipeline that predicts the next instruction based on past execution patterns.
When an interrupt occurs, the processor temporarily disables the branch predictor to prevent speculative execution attacks. However, this defense mechanism leaves a small window of vulnerability, allowing an attacker to time the interrupt to coincide with the predictor's sanitizing cycle, thereby re-poisoning the predictor after the defense has run.
This technique, known as INTERRUPT INJECT, can be exploited by an unprivileged Linux program to launch a timing attack on the branch predictor, effectively bypassing Spectre v2 defenses on Intel and AMD CPUs.