TONTOU attack bypasses Spectre v2 fixes, leaks Linux hashes

Researchers bypassed Spectre v2 mitigations with a TONTOU attack, leaking Linux kernel memory including /etc/shadow password hashes. On AMD Zen 2, the attack achieved 5.47 bytes/s at 91.97% accuracy. MIT CSAIL's Daniël Trujillo and Mengjia Yan presented findings at Black Hat USA.