Researchers earned $150K for “L1TF Reloaded,” combining L1TF and half-Spectre to leak VM memory from public clouds despite mitigations.Researchers from Vrije Universiteit Amsterdam earned $150K for exploiting L1TF Reloaded, a flaw combining L1TF (Foreshadow) and half-Spectre. The attack bypasses prior mitigations, showing that transient CPU vulnerabilities remain practical and can leak memory from VMs on public cloud services, exposing sensitive data.The L1TF Reloaded flaw allows bypassing mitigations and leak data from Google Cloud hypervisors and co-tenants. Using pointer-chasing, they translated guest virtual addresses to host physical ones, enabling leakage of any victim memory byte through L1TF.“we use L1TF together with a speculative out-of-bounds load to overcome all relevant security measures and leak sensitive data from the hypervisor and even a co-tenant on the Google cloud.” reads the paper published by the researchers. “Using a novel technique based on pointer chasing through the host and guest, we leak all information required to manually perform two-dimensional page table walks (i.e., through the guest’s page tables and extended page tables) in software; with this, we can translate arbitrary virtual guest addresses to host physical addresses, enabling the leakage of any byte in the memory of the victim via L1TF.”The researchers tested their exploit on Google Cloud, leaking an Nginx TLS key from a victim VM in ~14 hours, even under noisy conditions. The attack abused a half-Spectre gadget in Linux’s KVM to load data speculatively, then used L1TF to leak it. From a malicious VM, they accessed host OS data, identified co-tenant VMs, and stole sensitive keys. On AWS, defenses limited leaks to non-sensitive host data.“We ran the exploit for total of 28 runs on the aforementioned six different physical hosts, out of which 25 completed successfully.” continues the papert. “Each successful exploit run leaked the entire private key correctly. More specifically, among the successful exploit runs, the average run time was 14.2 hours (standard deviation: 16.2 hours), which was spent as follows: Find Gadget Base: 10.9h (76.3%)Find Victim VM in Host: 2.6h (18.3%)Find Victim Nginx in Guest: 0.3h (2.2%)Leak Nginx’s TLS key: 0.4h (3.2%)Note the large standard deviation: the initial step of finding the gadget’s base can take half an hour if we are lucky, or 3 days if we are not.”Researchers tested their L1TF exploit under extreme cloud noise (heavy disk and network I/O plus intensive cache pressure) and found it still worked reliably. They filled a host with vCPUs running aggressive I/O and memory/cache thrashing while hitting a victim Nginx server 100×/s. Across 10 noisy runs on GCE the exploit succeeded every time, leaking the key in an average 15.2 hours. The team concludes the attack remains robust even under realistic, high-noise cloud conditions.The researchers recommend disabling SMT or EPT plus L1D flushing to mitigate L1TF, but warn that these measures can reduce performance and stay enabled by default in Linux. Standard defenses like flushing and core scheduling don’t block guest-to-host attacks if sensitive data loads via a half-Spectre gadget. On AWS, extra protections like XPFO and process-local memory blocked leaks of guest data, leaving only harmless host info exposed. The researchers warn that transient execution flaws are still dangerous, since new exploit tricks could break through cloud defenses, as already shown on GCE.Google awarded researchers $151,515, which is the top Google Cloud VRP payout.“Researchers from the VUSec group invited Google to go to Amsterdam to discuss research ideas like the one presented in this blog post, and some time later VUSec proposed this research project, which Google sponsored with a sole-tenant node in order to conduct the research safely without potentially affecting any other customers.” states Google. “Once VUSec succeeded, they visited Google’s offices in Zurich where they presented their results. Google awarded a $151,515 USD reward for their results, the highest reward tier for our Google Cloud VRP and the first time researchers have been rewarded at this level.”Follow me on Twitter: @securityaffairs and Facebook and MastodonPierluigi Paganini(SecurityAffairs – hacking, Google)