Spectre Variant Returns: Branch Target Reuse Attack Extracts Root Password Hash from Linux Memory

Researchers from VUSec and Scuola Superiore Sant’Anna have published details of Branch Target Reuse (BTR), a new variant of the Spectre v2 attack. The technique exploits the fact that modern CPUs retain branch predictor state even after the original code has been replaced in memory.

When a JIT compiler frees a memory region and later reuses the same virtual address for new executable code, the processor’s branch predictor may still hold an outdated entry. During speculative execution the CPU follows the stale prediction, executes instructions from the previous code, and leaves observable traces in the cache that allow secret data to be recovered.

The researchers confirmed the problematic behavior across tested Intel, AMD, and Arm processors. They examined JIT engines in Firefox, GraalVM, and the Linux kernel, although practical exploitation results varied significantly between environments.

The most concrete demonstration involved two exploits against the Linux kernel. On an Intel system running with current mitigations active, the attackers were able to extract the root password hash within minutes. The attack recovers only the hash; it does not yield the plaintext password or enable direct root login.

A proof-of-concept was also prepared for Firefox, although turning it into a reliable browser exploit still requires additional work. In GraalVM experiments, predictor-state clearing made reliable exploitation difficult. Successful attacks require the ability to run unprivileged code inside a suitable JIT environment; processor model alone does not guarantee exploitability.

Defenses have already been implemented in the Linux kernel and GraalVM. Mozilla is focusing on completing site isolation deployment. The disclosure once again shows that Spectre-class vulnerabilities continue to surface as long as processors use speculative execution to improve performance.