New TONTOU Attack Slips Past Spectre v2 Defenses to Grab Linux Password Hashes

Robert Moore · 2026-08-06

You'd think after years of Spectre headaches, we'd finally be in the clear. Not quite. Researchers just dropped a new twist in the saga: a CPU attack called TONTOU that quietly bypasses the latest Spectre v2 fixes and leaks sensitive data straight from Linux machines. And yes, that includes password hashes. If your job involves keeping systems locked down, this one deserves your full attention. Because this isn't just another theoretical paper — it's a working exploit that shows how speculative execution attacks are far from dead. ### What Exactly Is TONTOU? TONTOU is a new speculative execution side-channel attack that targets the same underlying hardware weakness as Spectre v2, but it takes a different path to get there. Instead of rehashing the same old tricks, the researchers found a way to abuse a specific CPU behavior that the current mitigations simply don't cover. The name might sound playful, but the implications are serious. The attack can read kernel memory, including password hashes stored in /etc/shadow, which is about as sensitive as it gets on a Linux system. ### How Does It Bypass the Fixes? Spectre v2 mitigations, like retpolines and IBRS (Indirect Branch Restricted Speculation), were designed to stop attackers from tricking the CPU into speculatively executing the wrong code. TONTOU sidesteps those defenses by targeting a different part of the speculative execution pipeline. Think of it like this: the previous fixes locked the front door, but TONTOU found an open window. The researchers demonstrated that by carefully manipulating branch predictions, they could leak data that should have been off-limits, even on fully patched systems. ### What This Means for Linux Users Here's the uncomfortable truth: if you're running a Linux server or workstation with an Intel or AMD CPU from the last decade, you could be exposed. The attack doesn't require physical access — it can be executed remotely, though the practical exploitation is more complex in real-world scenarios. - Password hashes from /etc/shadow can be extracted - Kernel memory contents become readable - Other sensitive data in memory is at risk That said, the researchers didn't just drop the bomb and walk away. They've shared their findings with CPU vendors, and patches are already in the works. But until those land, the window is open. ### What Should You Do Right Now? Don't panic, but do get proactive. Here's a practical checklist to tighten your defenses while the industry catches up: - **Monitor for vendor updates**: Intel and AMD are working on microcode patches. Apply them as soon as they're available. - **Harden your kernel**: Use the latest LTS kernel and enable all available security features like KASLR and SMEP. - **Limit local access**: This attack requires code execution on the target machine, so restrict who can run code on your systems. - **Use strong password hashing**: If an attacker does leak hashes, strong algorithms like bcrypt or argon2 make cracking them significantly harder. > The researchers note that while this attack is powerful, it's not trivial to pull off. It requires precise timing and a deep understanding of the target's CPU architecture. This isn't a script-kiddie tool — yet. ### The Bigger Picture TONTOU is a stark reminder that speculative execution attacks aren't a solved problem. Every mitigation we've built so far has been a patch, not a fix. The hardware itself is fundamentally flawed in how it handles speculation, and until chipmakers redesign their cores from the ground up, we'll keep seeing new variants. For security professionals, this means staying vigilant and not assuming that "patched" equals "safe." The cat-and-mouse game between researchers and hardware vendors is far from over. ### Final Thoughts This discovery is a wake-up call for anyone running Linux in production. The good news? We now know about the attack, and the security community is already mobilizing. The bad news? There's likely more where this came from. Stay updated, keep your systems patched, and don't let your guard down. The next TONTOU might already be in the works. What's your take on this? Have you had to deal with speculative execution vulnerabilities in your environment? Let's talk about it in the comments.