A Security RISC? The State of Microarchitectural Attacks on RISC-V

on YouTube ↗47m

" summary

Analysis targets two commercial RISC‑V cores (Allwinner D1 / c906 and SiFive U74) and releases working proof‑of‑concepts on GitHub. Findings: split instruction/data caches prevent classic flush+reload but a new flush-and-fault trick (misaligned jump + fault handling) restores cache timing; the RISC‑V standard leaves unprivileged performance counters (cycles, retired instructions) so a timing scan reliably performs a KASLR break via page‑walk timing; speculative prefetching creates an instruction‑cache side channel, and on a newer board a full transient‑execution Spectre on COTS RISC‑V exploit successfully leaks memory.

AI-written summary · about

" chapters (15)

1. 0:00Microarchitectural attacks on RISC-V
2. 1:06Why security matters
3. 3:59CPU vulnerabilities state-of-the-art
4. 6:29RISC-V open-source alternative
5. 8:14Analyzing RISC-V hardware cores
6. 9:58CPU basics and attack vectors
7. 13:28Flush and Reload attacks deep dive
8. 17:43Cache attacks on RISC-V
9. 22:17Performance counters attack surfaces
10. 26:14Breaking kernel ASLR with counters
11. 29:49Spectre basics and branch prediction
12. 33:43Exploiting speculative prefetching
13. 35:49First Spectre on RISC-V
14. 38:00Summary and future outlook
15. 40:51Q&A

" related talks

• 19mAn Open Source Approach to System SecurityHelena Handschuh · RISC-V Summit 2019
• 17mSecuring High-performance RISC V-Processors from Time SpeculationChris Celio · 8th RISC-V Workshop Barcelona 2018
• 13mRISC-V: Securing the Future of Open Source ComputingAndrew Dellow · Spring 2022 RISC-V Week — RISC-V International Day
• 21mRISC-V International Security OverviewHelena Handschuh · RISC-V Forum: Security 2021
• 25mRISC-V Zkt: Portable Timing Attack Resistance (via Dynamic Taint Analys...Markku-Juhani O. Saarinen · RISC-V Summit 2022
• 18mCPU Security in the Context of RISC-VKarthik Raj Shekar · RISC-V Summit North America 2024
• 36mExploiting Buffer Overflows on RISC-VChristina Quast · KubeCon + CloudNativeCon China 2019
• 01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...Allison Randal, Giorgos Christou · RISC-V Summit 2022