A new attack named BTR, a variant of Spectre v2, threatens Linux systems equipped with recent Intel processors. In just a few minutes, it allows the retrieval of the root password hash. This mechanism exploits a flaw in processor branch predictions and particularly targets JIT engines.
This technique, revealed by the VUSec team, highlights a persistent hardware weakness that software patches still struggle to effectively counter. For Linux administrators, it is better to understand how this attack works and how to protect against it quickly.
Here is what you need to know to grasp this vulnerability and its practical implications.
How BTR hijacks JIT engines to steal sensitive data on Linux
The JIT (Just-In-Time) engine, found in browsers or the BPF compiler of the Linux kernel, generates code on the fly to speed up operations. To optimize execution, the processor uses a mechanism called Branch Target Buffer (BTB). This stores the destination of indirect jumps to anticipate subsequent instructions.
The catch? When a block of JIT code is freed and then replaced in the same location, the processor retains its initial prediction, an obsolete residue. This causes speculative execution on outdated instructions, providing an exploit leveraged by BTR.
This speculative “execute-after-free” technique allows unprivileged code to hijack the execution flow and access system data via processor caches.
Exploiting the root hash in less than 5 minutes on Linux
In the researchers’ demonstration, the attack’s driver uses cBPF—a classic version of BPF accessible without privilege. A malicious program first triggers the predictor, then is deleted and replaced by a second program at the same address containing piped instructions.
Next, the attack scans the caches to reconstruct memory content, byte by byte. Admittedly, the pace is slow (8 bytes per second), but it is sufficient to precisely point to the right areas. For instance, when the su root command is executed, the password hash is loaded into memory. The PoC targets the memory of this process and retrieves the hash in a few minutes on a Lenovo.
This time varies depending on the generation of the Intel core—about 3 minutes on a Raptor Cove core, 5 minutes on a Lion Cove—making it a very short window for a critical impact attack.
Why current patches are still insufficient against BTR
There is a hardening option named bpf_jit_harden designed to scramble the values embedded in the JIT code to prevent these manipulations. Nevertheless, researchers have found ways to bypass it.
They hide their malicious instructions elsewhere in the compiled code, thus evading this protection. As a result, even with this option enabled, the root hash remains vulnerable. It’s like oiling an engine before disassembling it without warning that some parts are still fragile.
So far, other JIT engines like SpiderMonkey and GraalVM have shown to be a bit more resistant, but the specter of this flaw still looms.
The goal of processor manufacturers and vendors to neutralize BTR
All tested processors, whether Intel, AMD, or Arm, are affected by this prediction behavior that does not update when the code changes. In plain terms, no current chip yet fully addresses this scenario.
Manufacturers claim that applicable mechanisms exist, notably the IBPB (Indirect Branch Predictor Barrier), but they insist that the correction should primarily occur in the software layers. The perfect ground for a vote of confidence in free software in action.
Here are some advancements: Linux now triggers an IBPB on all cores when repeatedly executing cBPF programs at the same memory address. Oracle randomizes the JIT cache area for GraalVM, making reuse more complex. Mozilla is exploring similar solutions for Firefox but is betting on strict site isolation.
Some guidelines to secure your Linux servers against BTR
The sine qua non condition of the BTR attack is the ability to execute unprivileged code on the machine. In other words, the attacker must already have access to the system. It is not a classic remote attack but rather a post-compromise hack.
The affected Linux kernel versions are from 5.18 onwards. The necessary patches have been integrated into several releases such as 6.1.183, 6.6.145, and 7.2. Make sure to keep your system up to date.
Keep in mind that recovering the hash is one step. To crack this hash and obtain the plaintext password, one still needs to arm themselves with patience and appropriate resources.