How Can We Effectively Test Transient Execution Mitigations? - Russell Currey, IBM
Channel: The Linux Foundation
Date: 2022-08-08

Since the bombshell of Spectre and Meltdown dropped on the public in January 2018, there's been a steady trickle of new transient execution vulnerabilities over the years - with the recent BHI/Spectre-BHB (CVE-2022-0001 & CVE-2022-0002) as a timely reminder that this exploit class is the gift that keeps on giving. Hardware mitigations have been introduced with new CPU generations, but plenty of mitigations still exist in software, typically flushing various bits of state when switching between privilege boundaries. In the ongoing conflict between security and performance, how can we reliably know that are mitigations are working? We can write tests, but mitigation testing is tricky. Exploits that abuse microarchitectural details are inherently finicky, so making a functional test that you can run everywhere isn't easy. You can instead only test if a mitigation is correctly applied, but that doesn't tell you if it actually works against an attack. In this talk, Russell will discuss pros and cons of different testing methods, detail what's currently being used by the community, and look at how we could potentially do better in the future.