Inside Google's Discovery and Remediation of a Critical CPU Vulnerability
summary
Google discloses an internal discovery named Reptar, a CPU flaw that triggers machine check exceptions and—per Intel analysis—can escalate to full privilege takeover. Affected fleets include Google Cloud VMs, Borg clusters and Chrome OS devices; mitigation options are a vendor microcode update applied via hotload to avoid reboots or flipping a performance-related chicken bit (disable fsrm) with ~10% throughput loss. Incident follows an IMAC playbook, uses an automated CPU response toolkit to bootstrap remediation, and exposed a buggy IceBreak detector during rollout.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 6:27Machine instructions and CPU features
- 13:48Discovery of Reptar vulnerability
- 15:33Starting remediation process
- 16:17Assessing Reptar impact
- 21:38Finding affected systems
- 23:28Intel escalates vulnerability
- 26:40Remediation options explored
- 29:53Testing Intel's firmware fix
- 31:19Rolling out fixes safely
- 34:08Incident response team
- 38:36Final steps and disclosure
- 40:43Post-remediation lessons
- 42:08Google's CPU toolkit
- 43:09Closing and Q&A
related talks
45mInside Google's Discovery and Remediation of a Critical CPU Vulnerability
42mThe Hidden RCE Surfaces That Control the Droids
52mSecuring The Unseen: Vulnerability Research In Confidential Computing
30mSpectre, Meltdown, & Linux
39mExploiting Blind Memory Corruption in Cloud Services
42mCPU Fuzzing: Automatic Discovery of...
46mRIDLed with CPU bugs
24mThe Memory of a Meltdown