How I started chasing speculative type confusion bugs in the kernel and ended up wi...

on YouTube ↗38m

" summary

Built a dynamic taint-based scanner that instruments the kernel with DFSan/kdf, fuzzes syscalls, takes stack/register snapshots, emulates a flipped branch with an undo log, and flags secret-dependent speculative cache loads. The pipeline called Casper finds 1,379 gadgets, exposes a recurring list_for_each type‑confusion that needed a coding-style fix (kernel moves from C89 to C11), forces 80 patches merged so far, reveals 450+ iterator uses to audit, and leaves about 300 locations still to fix.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 5:56What defenses are deployed in the kernel?
3. 27:22Type Confusion in C
4. 28:29The correct way

" related talks

• 43mSyzbot and the Tale of Thousand Kernel BugsDmitry Vyukov · Linux Security Summit North America 2018
• 59mSanitizing the Linux Kernel — On KASAN and other Dynamic Bug-finding ToolsAndrey Konovalov · Linux Security Summit Europe 2022
• 29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a BugQingyu Li, Huinian Yang · Black Hat Europe 2022
• 43mDebug for Bug: Crack and Hack Apple Core by ItselfMoony Li, Lilang Wu · Black Hat USA 2019
• 39mFuzzing the Native NTFS Read-Write Driver (NTFS3) in the Linux KernelEdward Lo, Chiachih Wu · Black Hat Asia 2023
• 42mCPU Fuzzing: Automatic Discovery of...Daniel Weber, Michael Schwarz · RuhrSec 2023
• 35mDeep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernelYudai Fujiwara · CODE BLUE 2023
• 31mHow Double-Fetch Situations turn into Double-Fetch Vulnerabilities...Steve Dodier-Lazaro, Pengfei Wang, Jens Krinke, Kai Lu, Gen Li · 26th USENIX Security Symposium (USENIX Security '17)