How Can We Effectively Test Transient Execution Mitigations?
summary
Describes a prototype pass‑fail CI test suite that runs transient execution exploits as regression tests, rewritten in C from Google SafeSide and using the memory oracle and cache side‑channel techniques, aiming for statistical confidence rather than flaky demos. Covers current mitigation checks like /sys/devices/system/cpu/vulnerabilities, transient.fail and spectre BHB CVEs, explains why distro kernel configs microcode and firmware make verification hard, and reports the suite is early stage but runnable and intended for automated CI.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:32About Russell
- 1:09Background
- 3:31Transient Execution
- 4:57Transient Execution Example
- 6:29Spectre Meltdown
- 10:00How fixes get distributed
- 14:21How vulnerabilities are discovered reported
- 15:30What can go wrong
- 18:05How do you know youre safe
- 18:58What happens next
- 20:18TrustMeBro
- 24:30Resources
- 26:07How Could We Change
related talks
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
16mMitigating Transient-Execution Attacks with CHERI Compartments
01h 03mBPF and Spectre: Mitigating transient execution attacks
24mThe Memory of a Meltdown
25mThe Memory of a Meltdown
01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”
52mSecuring The Unseen: Vulnerability Research In Confidential Computing
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps