How Do We Know That Weak Memory Matters?
summary
Argues current evidence is weak that weak memory causes widespread system or security failures, citing only a single Rust Belt CVE and few reproducible incidents; notes browsers, JVMs and compilers as promising targets where JVM type confusion or compiler reordering could break sandboxing; compares the situation to microarchitectural timing attacks that became urgent once people built exploits; urges a shift from paper models to build exploits and publish system CVEs, case studies and reproducible test cases.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:11Client’s weak memory question
- 3:55Formal methods priorities
- 6:47Evidence of real-world impact
- 9:15Counter-hypotheses on weak memory
- 12:27Need for stronger evidence
- 13:49Build exploits instead of models
- 16:18Targets for weak memory exploits
- 21:58More hackers in research
related talks
50mSmashing the Stack: Let’s Make It Less Fun And Unprofitable!
46mRethinking Architectures and Abstraction for a World Where Security Improvements Matter More than Performance Gains
01h 01mMemory Safety: Rust vs. C
01h 00mIntroduction to memory exploitation
01h 06mSecurity Beyond Memory Safety - Using Modern C++ to Avoid Vulnerabilities by Design
25mThe Memory of a Meltdown
30mLocknote: Conclusions and Key Takeaways from Day 1
57mFinding, Managing, Preventing Vulnerabilities: An Automotive Perspective