Fast and fine-grained compartmentalisation in CHERI
summary
Demonstrates a CHERI-enabled out-of-order superscalar RISC-V core running CheriBSD on a DE10Pro FPGA, using 128-bit capabilities to enforce per-library stacks so a malicious image-compress library that overwrites stack offset 147 fails with an address-space security exception. Shows library compartmentalisation containing a stack-spraying supply-chain attack, includes a working port of nginx (Engine X) under compartmentalisation, and reports the demo runs successfully with measurable isolation.
AI-written summary · about
chapters (6)
- 0:00Introduction to CHERI
- 1:40Library compartmentalisation concept
- 4:06CHERI BSD on FPGA demo
- 6:52Security breach mitigation demo
- 8:39Nginx porting and live demo
- 10:07Q&A and closing
related talks
10mCHERI in out-of-order microarchitectures
12mLibrary-based Compartmentalisation on CHERI
11mDemo: Securely Booting CHERI on a Full OS to Prevent Buffer Overflow Attacks
16mMitigating Transient-Execution Attacks with CHERI Compartments
53mLinux and CHERI: Back to the Future
17mHardening Linux and FreeBSD on RISC-V with CHERI
01h 33mHands-on Introduction to CHERI
31mMemory Safety: The Pernicious Challenge