Inside Google's Discovery and Remediation of a Critical CPU Vulnerability
summary
A critical Intel CPU bug called Reptar causes machine‑check exceptions that can crash hosts and thus cloud tenants; exploit reproducer uses the icebreak test harness and relied on FS/ERMS prefixed instructions. Mitigations include a microcode patch (hot‑loaded without reboot) or flipping a chicken bit that disables FS/ERMS at ~10% performance cost. Response follows Google’s iMac playbook, produces a Google CPU response toolkit that automates rollout prep and is successful in subsequent incidents.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 5:31Vulnerability Coordination Center
- 13:21CPU instructions and registers
- 21:18Systems vulnerable to Reptar
- 26:14Affected machines and fixes
- 31:58Microcode updates without reboot
- 33:46Incident Management at scale
- 37:59Disclosure and analysis
- 41:18Lessons learned
related talks
44mInside Google's Discovery and Remediation of a Critical CPU Vulnerability
34mDynamic mitigations
42mThe Hidden RCE Surfaces That Control the Droids
30mSpectre, Meltdown, & Linux
42mCPU Fuzzing: Automatic Discovery of...
46mRIDLed with CPU bugs
52mSecuring The Unseen: Vulnerability Research In Confidential Computing
19mKeynote: MDS, Fallout, Zombieland & Linux