BPF and Spectre: Mitigating transient execution attacks
summary
Shows proof‑of‑concept exploits that use speculative store bypass and memory disambiguation to make unprivileged eBPF read kernel memory, and describes concrete defenses added to the verifier and JIT: path‑aware register tracking with tnums, function‑by‑function verification, on‑demand scalar precision, the 1M‑instruction verification cutoff, load hardening and a new eBPF “no‑spec” / stack barrier instruction that forces store‑address resolution. Tests run against Intel microarchitectures validate leaks; mitigations apply to unprivileged programs while privileged BPF skips some checks for performance.
AI-written summary · about
chapters (10)
- 0:00Introduction to bpf and spectre
- 1:06Understanding the bpf framework
- 4:40Inside the bpf verifier
- 10:18Register tracking and verifier challenges
- 18:40Speculative execution fundamentals
- 27:13Side channels and leakage in bpf
- 34:18Spectre v1 and v4 vulnerabilities
- 40:44Mitigation implementation and analysis
- 50:06Conclusion and future outlook
- 52:39Question and answer session
related talks
57mBPF and Security. Friends and Foes
43mHotBPF++: A More Powerful Memory Protection for the Linux Kernel
33meBPF: exploring use case of BPF kernel infrastructure
01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”
40mExploring Runtime Security and Forensic using eBPF
42mResolving Performance and Security Issues with eBPF
32meBPF: The Next Power Tool of SREs
13mExploiting Inaccurate Branch History in Side-Channel Attacks