Proactive Software Defense against Side Channel Attacks

on YouTube ↗30m

" summary

Small team (about 2.5 people) presents concrete kernel defenses: a researched design to relink kernel each boot by relocating .o sections at boot to raise attack cost (complicates livepatching, signatures and reproducibility); a merged module-text randomizer that yields about 17 bits of entropy and faster module load times; a proposed mlock flag for secret pages to prevent fork/copy and disable caching; and a proof‑of‑concept that does per‑CPU cache perturbation on syscall error (uses MSR or junk reads) with unknown performance impact.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 2:30Specter in Meltdown Attacks
3. 5:55Kernel Address Randomization
4. 10:16Impact Live Patching
5. 12:51Kernel Address Randomized Link

" related talks

• 24mShielding Software From Privileged Side-Channel AttacksXiaowan Dong · USENIX Security '18
• 37mDerandomizing Kernel Object Locations w Software Hardware-Induced Side ChannelsLukas Maar · Nullcon Berlin 2025
• 38mTaking Kernel Hardening to the Next LevelTaesoo Kim, Jinbum Park, Haehyun Cho, Seolheui Kim, Yeji Kim, Bumhan Kim, Sungbae Yoo · Black Hat Asia 2022
• 41mUsing Microarchitectural Design to Break KASLR and MoreAnders Fogh · RuhrSec 2017
• 46mThe State of Kernel Self Protection ProjectKees Cook · Linux Security Summit 2016
• 01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...Allison Randal, Giorgos Christou · RISC-V Summit 2022
• 29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux KernelMark Rutland · Embedded Linux Conference + OpenIoT Summit Europe 2016
• 25mKernel Self-Protection ProjectKees Cook · Linux Security Summit North America 2019