Mosfetti Forum

Speculative execution bugs did not end in 2018. They evolved. Research covered by BleepingComputer on a Spectre v2 bypass technique referred to as TONTOU is a reminder that CPU side channels remain a long game — especially on Linux systems where researchers demonstrated leakage risks including sensitive kernel memory contents in lab conditions.

Source: New TONTOU CPU attack bypasses Spectre v2 fixes — BleepingComputer

What is confirmed vs what is hype

Confirmed in public reporting of the research:

• Spectre v2 style issues continue to produce new bypass techniques
• Lab demos can leak sensitive data such as password hashes under specific conditions
• Both Intel and AMD platforms have been part of testing narratives for this class of work

Not automatically true:

• That every home desktop is “owned” tomorrow without local code execution / shared tenancy assumptions
• That a single BIOS checkbox removes the entire class forever
• That turning off all mitigations is free performance with no tradeoffs

Practical Linux admin posture

• Track distro security advisories for microcode + kernel mitigation updates
• Do not casually disable Spectre mitigations on multi-user or hosted boxes for benchmarks
• Remember defense in depth: hashed passwords still need strong hashing + unique salts; leakage is bad either way
• Shared hosting and CI runners have a different threat model than a single-user gaming PC

Discussion

For your personal machines, do you run full mitigations, selective ones, or “turn it off I want FPS” — and does that choice change on anything that faces a network?