RIDLed with CPU bugs
summary
RIDL demonstrates that speculative execution leaks occur from internal CPU buffers (not caches) — notably line fill buffers — and can expose kernel memory, VM data, SGX secrets and even browser-held data via WebAssembly. The authors test Intel CPUs across generations back to 2008 (many models vulnerable), fail to reproduce on tested AMD chips, and implement exploits using flush+reload, eviction sets, page-fault tricks and SSH/client loops co‑located on shared hyperthreads. Mitigations include microcode/OS buffer clears and disabling hyper‑threading; some fixes degrade performance and still leave cross‑thread windows.
AI-written summary · about
chapters (21)
- 0:00Intro
- 2:23CPU ERRATA
- 7:17INTEL CPU
- 8:07MDS ATTACKS
- 8:37BACKGROUND
- 10:10FLUSH + RELOAD
- 11:29PREVIOUS ATTACKS
- 16:04SECURITY DOMAINS
- 19:29LEAKY SOURCES
- 20:44MANUALS
- 21:28LINE FILL BUFFERS?
- 23:09EXPERIMENTS
- 24:47CONFUSED DEPUTY
- 28:45FILTERING
- 30:09THREAT MODEL
- 30:47IN-FLIGHT DATA
- 31:07LEAKING
- 32:52ARBITRARY KERNEL LEAK
- 34:29PORTABILITY
- 36:05FROM THE BROWSER
- 39:06RIDL MITIGATIONS
related talks
47mA Security RISC? The State of Microarchitectural Attacks on RISC-V
51mExploiting Hardware Glitches And Side Channels In Perfect Software
36mExploiting Buffer Overflows on RISC-V
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
35mSingle Instruction Multiple Data Leaks in Cutting-edge CPUs, AKA Downfall
28mComplexity Killed Security
52mSecuring The Unseen: Vulnerability Research In Confidential Computing