New Spectre BTR attack exposes Linux root password hashes

Researchers have unveiled a new Spectre Variant 2 attack, named Branch Target Reuse (BTR), that can extract root password hashes from Linux systems running on Intel processors within minutes. The BTR exploit manipulates leftover entries in the CPU's branch predictor when just-in-time engines reuse memory, bypassing defenses previously thought effective. The vulnerability impacts JIT engines in browsers, language runtimes, and the Linux kernel. Vendors have been notified and Linux kernel fixes have been issued.

• BTR variant recovers Linux root password hashes
• Attack exploits reused branch predictor entries in CPUs
• Impacts JIT engines in Linux, browsers, and runtimes
• Researchers leaked hashes in under 5 minutes in tests
• Patch has been merged into the Linux kernel