Hardening the Linux Guest for the Confidential Cloud Computing: Deep Dive and Results
summary
Project hardens mainline Linux guests for confidential VMs by auditing and fuzzing the host-controlled inputs that now constitute a huge attack surface. It builds three static tools (including smudge static analyzer) and an elaborate boot-aware fuzzing setup with about 24 boot harnesses, focuses on MSRs, CPUIDs, port IO, MMIO and PCI config space, finds many PCI-related indexing bugs in 5.15 (some fixed by 5.17), and limits drivers and shared-memory features. Work is ongoing, team ~4 people, tools and patches are public.
AI-written summary · about
chapters (8)
- 0:00Project introduction
- 6:45Confidential threat model
- 12:37Hardening methodology
- 14:48Input vector analysis
- 26:35Shared memory and system
- 34:33Kernel infrastructure risks
- 39:34Speculative execution
- 43:54Results and collaboration
related talks
20mHardening Linux guest kernel for CC
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
41mConfidential Computing, from host to workload
52mSecuring The Unseen: Vulnerability Research In Confidential Computing
52mKernel Hardening: Ten Years Deep
38mHardening the Barebox Bootloader
36mEverybody is talking about Confidential Computing - the minimum Devs should know
26mFuzzing Host-to Guest Attack Surface in Android Protected KVM