How Can We Effectively Test Transient Execution Mitigations?

on YouTube ↗30m

" summary

Describes a prototype pass‑fail CI test suite that runs transient execution exploits as regression tests, rewritten in C from Google SafeSide and using the memory oracle and cache side‑channel techniques, aiming for statistical confidence rather than flaky demos. Covers current mitigation checks like /sys/devices/system/cpu/vulnerabilities, transient.fail and spectre BHB CVEs, explains why distro kernel configs microcode and firmware make verification hard, and reports the suite is early stage but runnable and intended for automated CI.

AI-written summary · about

" chapters (14)

1. 0:00Introduction
2. 0:32About Russell
3. 1:09Background
4. 3:31Transient Execution
5. 4:57Transient Execution Example
6. 6:29Spectre Meltdown
7. 10:00How fixes get distributed
8. 14:21How vulnerabilities are discovered reported
9. 15:30What can go wrong
10. 18:05How do you know youre safe
11. 18:58What happens next
12. 20:18TrustMeBro
13. 24:30Resources
14. 26:07How Could We Change

" related talks

• 01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...Allison Randal, Giorgos Christou · RISC-V Summit 2022
• 16mMitigating Transient-Execution Attacks with CHERI CompartmentsFranz Fuchs · RISC-V Summit Europe 2023
• 01h 03mBPF and Spectre: Mitigating transient execution attacksDaniel Borkmann · PriSC 2022
• 24mThe Memory of a MeltdownShane Cota, Chris Magistrado · BSidesSF 2018
• 25mThe Memory of a MeltdownShane Cota, Chris Magistrado · BSidesSF 2018
• 01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”Chandler Carruth · CppCon 2018
• 52mSecuring The Unseen: Vulnerability Research In Confidential ComputingJosh Eads, Cfir Cohen · Hardwear.io USA 2023
• 48mCapturing 0Day Exploits With Perfectly Placed Hardware TrapsCody Pierce, Matt Spisak, Kenneth Fitch · Black Hat USA 2016