Tutorial: Side-Channel Attacks and Transient Execution Vulnerab...
summary
Covers concrete side channels (power, EM, timing, cache, TLB, DRAM rowhammer) and shows how transient execution leaks secrets by creating microarchitectural state that survives until retirement, enabling Meltdown-style cache exfiltration and Spectre-style predictor mistraining. Describes defenses that actually work versus costly mitigations: avoid creating microarchitectural state for faulting loads, Spec Terminator: 2.6% cache penalty, 6% for all variants, and verification tools used by silicon vendors. Presents RISC-V CFI options with tradeoffs: shadow stacks and execute-only memory, memory tagging, pointer authentication, landing‑pad labels, and measured performance/memory costs.
AI-written summary · about
chapters (28)
- 0:00Introduction to tutorial
- 0:41Side vs covert channel attacks
- 2:23Physical side-channel basics
- 7:00Microarchitectural vs physical channels
- 8:47Cache timing side-channel attacks
- 11:58Rowhammer bit-flip attacks
- 12:59Transient execution overview
- 16:09Meltdown vulnerability details
- 19:18Spectre attack mechanisms
- 22:05Spectre countermeasures and costs
- 23:54Spectre amplification attacks
- 25:19Security verification tools pitch
- 26:33Rowhammer explanation
- 27:57Control Flow Integrity intro
- 29:22Memory corruption vulnerabilities
- 31:51Code reuse attacks explained
- 33:39Traditional defense mechanisms
- 36:35Heuristic detection techniques
- 40:08Detection-based defenses
- 41:53Memory tagging limitations
- 43:39Pointer authentication overview
- 45:29Dynamic information flow tracking
- 47:15Pointer bounds protection
- 49:02Execute-only memory technique
- 51:15Shadow stacks explained
- 53:24Control Flow Integrity proposals
- 56:56CFI granularity comparison
- 59:50CFI benefits and drawbacks
related talks
01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”
24mThe Memory of a Meltdown
16mMitigating Transient-Execution Attacks with CHERI Compartments
25mThe Memory of a Meltdown
30mHow Can We Effectively Test Transient Execution Mitigations?
48mSpeculative execution vulnerabilities
51mKeynote |The Microarchitectures That I Saw And The Ones That I Hope To One Day See
46mRethinking Architectures and Abstraction for a World Where Security Improvements Matter More than Performance Gains