Interrupt Injection: How a New Attack Bypasses Spectre v2 Defenses on Intel and AMD CPUs

Introduction

Since the disclosure of Spectre and Meltdown in early 2018, the security community has been locked in a relentless race against micro‑architectural side‑channel attacks. The original Spectre v2 (also known as Branch Target Injection) forced chip manufacturers to roll out a patch‑heavy suite of mitigations—retpolines, indirect branch restricted speculation (IBRS), and microcode updates that altered the way speculative execution interacts with the branch predictor. While these defenses have been widely deployed across data‑center fleets, a newly discovered technique called Interrupt Injection threatens to undermine the very assumptions that underlie those mitigations.

In this article we examine the technical underpinnings of Interrupt Injection, assess why it can sidestep existing Spectre v2 defenses on both Intel and AMD silicon, and explore the broader ramifications for enterprises, cloud providers, and regional cybersecurity strategies. By weaving together recent research findings, vendor disclosures, and real‑world deployment data, we aim to provide a comprehensive, forward‑looking analysis that goes beyond the usual event‑reporting narrative.

Main Analysis

1. The Evolution of Spectre v2 Mitigations

Spectre v2 exploits the fact that modern CPUs predict the target of an indirect branch and speculatively execute instructions at that predicted address. Early mitigations fell into two categories:

• Software‑level retpolines: Compiler‑generated “return trampolines” that replace indirect branches with a sequence that forces speculation to a safe loop.
• Hardware‑level controls: Microcode updates that introduce IBRS (Indirect Branch Restricted Speculation) and STIBP (Single Thread Indirect Branch Predictors) to limit cross‑core predictor leakage.

According to the Intel Technical Security Notices, by the end of 2022 more than 95 % of enterprise‑grade Xeon processors had received microcode patches that enable IBRS/ STIBP. AMD’s equivalent firmware updates covered roughly 88 % of EPYC 2nd‑generation chips.

2. What Is Interrupt Injection?

Interrupt Injection is a class of attack that leverages the asynchronous nature of hardware interrupts to manipulate the speculative execution path of a victim thread. The core idea is simple yet powerful:

1. An attacker, typically running in a less‑privileged user space, triggers a hardware interrupt (e.g., via a crafted I/O operation or a timer).
2. The CPU’s interrupt controller redirects execution to an interrupt handler that runs at a higher privilege level.
3. During the handler’s entry sequence, the CPU may speculatively fetch instructions from a location chosen by the attacker, effectively bypassing the branch‑target checks enforced by IBRS.

Because the interrupt handler is entered via a hardware‑driven control flow change rather than an indirect branch, the traditional retpoline or IBRS fences are not consulted. This creates a “speculation window” that can be exploited to read data from privileged memory, similar to classic Spectre v2 payloads.

3. Why Existing Defenses Fail

Both Intel and AMD designed their Spectre v2 mitigations around the premise that speculation only occurs after an indirect branch instruction. Interrupt Injection subverts this premise by:

• Bypassing the branch predictor: The CPU does not consult the indirect branch predictor when handling an interrupt; instead it uses a dedicated “interrupt vector” table.
• Exploiting the “shadow stack”: Modern CPUs maintain a shadow stack for return‑address verification. Interrupt handling can temporarily suspend shadow‑stack checks, opening a brief window for speculative mis‑prediction.
• Leveraging shared micro‑architectural resources: The attack re‑uses the same branch‑target buffer (BTB) entries that were previously poisoned, allowing the attacker to “re‑activate” a malicious prediction after the interrupt.

In short, the attack sidesteps the very mechanisms that IBRS and retpolines were built to protect, rendering them ineffective for the duration of the interrupt handling sequence.

4. Technical Walk‑through

To illustrate the attack, consider a Linux system running on an Intel Xeon Gold 6248 processor:

1. BTB Poisoning: The attacker first trains the BTB by repeatedly executing a branch that mis‑directs speculation to a gadget located in a shared library (e.g., libc).
2. Interrupt Trigger: The attacker then issues a perf_event_open call that creates a high‑frequency performance counter interrupt.
3. Handler Entry: When the interrupt fires, the CPU jumps to the kernel’s interrupt handler without consulting the BTB. However, the speculative engine still retains the poisoned BTB entry.
4. Speculative Execution: While the handler’s prologue is being fetched, the CPU speculatively executes the attacker‑controlled gadget, which reads a secret (e.g., a cryptographic key) from kernel memory and transmits it via a cache‑based side channel.
5. Leakage Extraction: The attacker measures cache latency using Flush+Reload to reconstruct the secret.

Crucially, the attack does not require any kernel‑level code execution; it merely relies on the fact that the interrupt handler’s entry sequence is not protected by the same speculation fences as ordinary indirect branches.

5. Real‑World Impact and Statistics

Since the public disclosure of Interrupt Injection in March 2024, several high‑profile vendors have reported the following figures:

• Intel’s internal security team logged 1,342 distinct interrupt‑related micro‑architectural anomalies across its 2023‑2024 product line.
• AMD’s “Secure Processor” team identified 7 % increase in speculative‑execution side‑channel events after enabling high‑resolution timers on EPYC 7763.
• A joint study by the Cloud Security Alliance (CSA) and the European Union Agency for Cybersecurity (ENISA) estimated that up to 18 % of cloud‑hosted workloads could be vulnerable to interrupt‑based Spectre bypasses, translating to an exposure of roughly 2.3 billion virtual machines worldwide.

6. Regional and Sectoral Implications