Towards Understanding Spectre-PHT in Memory-Safe Languages
summary
A testing framework instruments Rust libraries with SpecFuzz to simulate branch mispredictions (skipping annotated bounds checks), runs four-hour fuzz sessions with AddressSanitizer, and compares an unsafe and hardened build. Results show hundreds of residual Spectre-PHT reports (regex >200), a small library dropping from 5 to 3, and root causes concentrated in type confusion and speculative deallocation (temporal memory-safety). The tooling works as a discovery probe but inherits SpecFuzz’s high false-positive rate and ASan’s detection limits.
AI-written summary · about
chapters (10)
- 0:00Start
- 5:49Mitigations
- 6:36Index Masking
- 7:38Hardware Mitigations
- 15:20200 Vulnerabilities for Regex
- 16:02Root Causes
- 16:14Type Confusion
- 18:46First Type Confusion
- 19:46Conclusion
- 20:13Limitations
related talks
15mSpecSafe: Detecting Cache Side Channels in a Speculative World
01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”
56mSpectre/C++
19mCounterexamples in Safe Rust
59mBeyond Sanitizers...
50mSmashing the Stack: Let’s Make It Less Fun And Unprofitable!
28mDetecting Borrow and Provenance Bugs Across Unsafe Rust [...]
23mSecure Composition of SPECTRE Mitigations