Rage Against The Machine Clear

This course analyzes previously unexplored machine-clear causes of transient execution, including floating-point, self-modifying-code, memory-ordering, and memory-disambiguation clears. It presents FPVI and SCSB attack primitives, an end-to-end SpiderMonkey exploit, mitigations, and a root-cause classification of transient execution paths.

Syllabus

Intro
Side Channels 101
Bad Speculation
Rage Against The Machine Clear
Security Analysis of Machine Clear
Self-Modifying Code Machine Clear
Speculative Code Store Bypass (SCSB)
Memory Ordering Machine Clear
Floating-Point Machine Clear
3. Memory Leak
4. ASLR Bypass
Floating-Point Value Injection (FPVI)
Memory Disambiguation Machine Clear
Transient Execution Capabilities
Root-Cause Classification of Transient Execution
Disclosure & Affected CPUs