Interrupt Injection Attack Bypasses Spectre v2 Defenses on AMD Zen CPUs

Researchers at MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) have demonstrated a new side-channel technique, dubbed INTERRUPT INJECTION, that re-poisons a processor's branch predictor after the operating system has already sanitized it. Daniël Trujillo and Mengjia Yan showed that an unprivileged Linux program can time a hardware interrupt to land inside the narrow window between when the kernel runs its Spectre v2 mitigation and when the predictor is actually used, effectively neutralizing the defense without elevated privileges. The exploit needs only local code execution, putting shared multi-user systems, CI runners, and any host accepting untrusted local users at risk.

On an AMD Zen 2 machine running Linux 6.14 with all default Spectre v2 mitigations enabled, the proof of concept leaked arbitrary kernel memory at 5.47 bytes per second with 91.97 percent accuracy. That throughput was sufficient to locate and read /etc/shadow, the file that stores hashed user credentials, in five of ten attempts, a practical path to offline password cracking. Administrators can verify whether their systems are patched by checking the SRSO entry under /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow, though the kernel documentation defining that file's values did not mention the new interrupt-based vector at the time of disclosure. Given that stolen password hashes are the immediate payoff, running any exposed credentials through a strong password strength and breach checker remains a baseline precaution for operators of affected hosts.

The pair disclosed the issue to AMD and Intel on February 5. AMD confirmed it plans a kernel patch, which has since shipped in a standard OS update. The fix, titled "x86/bugs: Make Safe-RET robust against interrupt injection," was authored by AMD engineers Borislav Petkov and David Kaplan on June 2 and works by restoring register state as if the Safe-RET sequence had completed before the interrupt returns, blocking the second of the two exploitation routes the paper proposed. AMD later published security bulletin AMD-SB-7061 on August 6, listing Zen 1 through Zen 4 as affected and crediting Trujillo; the behavior was demonstrated on Zen 1 and Zen 2, with Zen 3 and Zen 4 flagged as suspected but unproven. Intel, meanwhile, informed the researchers it does not consider a mitigation necessary.

Neither AMD's bulletin nor MIT's announcement links directly to the kernel commit, and no CVE has been assigned, which forces administrators to track the patch by its subject line. AMD's affected-products section lists only processor families, with no patch reference, kernel version, or CVE identifier, complicating inventory and compliance work. Because the attack requires local execution, defenders should prioritize host hardening on multi-tenant and shared environments: audit local user accounts, restrict unprivileged code execution, and segment workloads where feasible. A broader privacy and exposure checkup is advisable for any organization running Zen 1 through Zen 4 hardware on Linux, and operators managing fleets can use the port and service scanner to confirm that no unintended local services are expanding the attack surface.