Linux Security Summit Europe 2024
2024-09-16..2024-09-17
Vienna, Austria
[Linux Security Summit Europe 2018, Linux Security Summit Europe 2019, Linux Security Summit Europe 2022, Linux Security Summit Europe 2023, Linux Security Summit Europe 2024, Linux Security Summit Europe 2025]
who it's for
kernel developers, distro maintainers, confidential computing engineers, security researchers, platform engineers, systemd maintainers
topics
slub internals and freelist; slab spraying exploitation techniques; HSM integration for VMs; linux keyring attestation; confidential computing on RISC-V; supply-chain backdoor analysis (XZ); eBPF quarantine and O2C; tpm integration with systemd; restricting unprivileged user namespaces; landlock ioctl support; VTL1 minimal secure OS (LVBS); signing and verifying eBPF programs
| title | author | length |
|---|---|---|
| Welcome & Opening Remarks | Elena Reshetova | 03m |
Stormy-morning announcements note a shuffled agenda with some talks flipped and a 45-minute first break to accommodate late arrivals, plus high in-person… | ||
| SLUB Internals for Exploit Developers | Andrey Konovalov | 01h 31m |
Explains concrete SLUB internals needed to turn slab bugs into exploits: allocation tiers (lockless active slab, pcpu partials, per‑node, new slab), freelist… | ||
| Enabling Hardware Security Modules for Confidential Computing | Reinhard Buendgen | 50m |
IBM Secure Execution for Linux on IBM Z enables virtual machines to safely use Crypto Express HSMs by creating a firmware-enforced binding between a guest and… | ||
| Hiding Attestation with Linux Keyring in Confidential Virtual Machines | Mikko Ylinen | 36m |
Claims that Linux keyring can hide attestation details for confidential VMs by using the request_key syscall to trigger a userland key provider that performs… | ||
| Enabling New Security Frontiers: Deep-Dive Into Implementing Confidential Computing on RISC-V | R... | 52m |
RISC‑V adds a proposal called Supervisor Domains plus modular ISA hooks: a scalable memory tracking table (smmt) that maps system physical addresses to… | ||
| The Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ... | René Mayrhofer, Mario Lins | 01h 09m |
An XZ Utils backdoor lets attackers run commands on SSH servers without prior auth by trojanizing liblzma and abusing build hosts; attackers gain commit rights… | ||
| Compartmentalizing Vulnerable Kernel Components Without Stopping the Machine | Qinrun Dai | 28m |
Claims an on-the-fly enforcement that quarantines vulnerable kernel objects without rebooting by auditing pre-existing “legacy” objects and blocking illegal… | ||
| Systemd & TPMs | Lennart Poettering | 01h 18m |
Systemd now ships concrete TPM tooling: systemd-cryptenroll creates TPM-locked root on first boot and systemd-cryptsetup unlocks disks with TPM/PKCS#11/FIDO… | ||
| Welcome Back & Remarks | Elena Reshetova | 01m |
Welcome back to the conference on the second day with a full program and optional time set aside for BoFs scheduled both in the main room and the adjacent room… | ||
| Restricting Unprivileged User Namespaces in Ubuntu | John Johansen, Maxime Bélair | 47m |
Ubuntu 24.04 ships a default restriction on unprivileged user namespaces and pairs it with AppArmor policy so sandboxing callers either get a confined profile… | ||
| Update on Landlock: IOCTL Support | Günther Noack | 48m |
Landlock adds explicit IOCTL control by restricting IOCTLs on device files by pathname and permitting a short whitelist of harmless commands (fcntl-like flags… | ||
| LVBS and Advanced Kernel Integrity | Thara Gopinath | 32m |
LVBS creates a VTL1 minimal Linux secure OS using Hyper‑V/VSM to enforce immutable EPT permissions for every guest kernel page at boot and injects intercepts… | ||
| Verifying and Signing EBPF Programs with Inspektor Gadget | Francis Laniel | 24m |
Inspektor Gadget packages eBPF programs as OCI images and signs them in CI with cosign, then verifies signatures at runtime and refuses execution of images… | ||
| Safer Seccomp: Dead Syscalls Elimination | Yuan Tan, Siqi Fan, Xiao Liu | 10m |
Implements dead syscalls elimination by rewriting the .pushsection assembler semantics so the linker can garbage collect syscall-related sections, and by… | ||
| nothing matches | ||