Demo: Securely Booting CHERI on a Full OS to Prevent Buffer Overflow Attacks
Talkat RISC-V Summit North America 2024 · on Tuesday, 2024-10-22· at 12:45· Expo Hall - Exhibit Hall A - Demo Theater·
summary
Full RISC-V Linux boot replaces integer pointers across secure boot, OpenSBI, U-Boot, kernel and userland with capability-typed pointers on an FPGA bitstream; system runs as a Codasip x730 (CHERI) at 100 MHz with a "pure-cap" kernel + BusyBox. A known sudo privilege-escalation exploit runs to root on a non-CHERI A730 but on the CHERI core the attack triggers a CHERI data-fault length violation kills process and no secrets are exposed; kernel support is early but the demo boots and enforces bounds.
AI-written summary · about
chapters (8)
- 0:00Introduction to memory corruption
- 1:28What is CHERI technology
- 3:58PureCap boot chain implementation
- 5:47FPGA boot process start
- 6:35Linux kernel with CHERI protection
- 8:43Privilege escalation demo setup
- 9:26Exploit attempt on standard system
- 10:24Exploit blocked on CHERI system
related talks
10mCHERI in out-of-order microarchitectures
11mFast and fine-grained compartmentalisation in CHERI
53mLinux and CHERI: Back to the Future
25mLightning Talk: Protecting Zephyr Against Memory Safety Vulnerabilities With the New CHERI Hardware Architecture
31mMemory Safety: The Pernicious Challenge- 25mLightning Talk: Protecting Zephyr Against Memory Safety Vulnerabilities With the New CHERI Hardware Architecture
01h 33mHands-on Introduction to CHERI
20mMaking CHERI Accessible