$150K awarded for L1TF Reloaded exploit that bypasses cloud mitigations

Researchers from Vrije Universiteit Amsterdam earned $150K for “L1TF Reloaded,” a flaw that combines L1TF (Foreshadow) and half-Spectre to leak VM memory from public clouds despite mitigations. The attack bypasses prior mitigations and can leak data from Google Cloud hypervisors and co-tenants, using pointer-chasing to translate guest virtual addresses to host physical ones. The researchers tested their exploit on Google Cloud, leaking an Nginx TLS key from a victim VM in around 14 hours under noisy conditions.

On AWS, defenses limited leaks to non-sensitive host data, according to the findings. The researchers warn transient execution flaws remain dangerous as new exploit tricks could break cloud defenses, as already shown on GCE. Google awarded researchers $151,515, which is the top Google Cloud VRP payout, according to Google.