Affected Systems

Intel and AMD processors with Spectre v2 mitigations (eIBRS on Intel, Safe RET on AMD). Confirmed exploitable on AMD Zen 2 systems running Linux kernel 6.14.0-37-generic. Intel systems also vulnerable but require additional software prerequisites. Attack requires unprivileged local code execution.

Exploitation Status

Proof-of-concept demonstrated by MIT CSAIL researchers. Successfully extracted /etc/shadow password hashes from AMD Zen 2 Linux systems at 5.47 bytes/s with 91.97% accuracy. No evidence of active exploitation in the wild. Research presented at Black Hat USA 2026.

Business Impact

Attackers with unprivileged local access can leak arbitrary kernel memory, including password hashes from /etc/shadow, bypassing existing Spectre v2 defenses. Exploitation requires 18 minutes average per successful extraction. Attack complexity is high, requiring precise interrupt timing and branch predictor manipulation. Primary risk is to multi-tenant environments (cloud, shared hosting) where untrusted users can execute code. Single-tenant systems with strong access controls face lower immediate risk.

Urgency

🟡 Within a week

Recommended Actions

  • Monitor vendor advisories from Intel, AMD, and Linux distributions for microcode and kernel patches addressing TONTOU (CVE assignment pending)
  • Review and restrict unprivileged user access on multi-tenant Linux systems, particularly AMD Zen 2 and newer processors
  • Enable kernel audit logging for timer interrupt patterns and unusual /etc/shadow access attempts on high-value Linux systems
  • Prioritize patching for cloud infrastructure, container hosts, and shared hosting environments where untrusted code execution is possible
  • Test patches in non-production environments first, as Spectre mitigations historically impact performance (expect 5-15% overhead)