The Experts below are selected from a list of 168 Experts worldwide ranked by ideXlab platform

Frank Piessens - One of the best experts on this subject based on the ideXlab platform.

  • a tale of two worlds assessing the vulnerability of enclave shielding runtimes
    Computer and Communications Security, 2019
    Co-Authors: Jo Van Bulck, David Oswald, Eduard Marin, Abdulla Aldoseri, Flavio D Garcia, Frank Piessens
    Abstract:

    This paper analyzes the vulnerability space arising in Trusted Execution Environments (TEEs) when interfacing a trusted enclave application with untrusted, potentially malicious code. Considerable research and industry effort has gone into developing TEE runtime libraries with the purpose of transparently shielding enclave application code from an adversarial environment. However, our analysis reveals that shielding requirements are generally not well-understood in real-world TEE runtime implementations. We expose several sanitization vulnerabilities at the level of the application binary interface (ABI) and the application Programming interface (API) that can lead to exploitable memory safety and side-channel vulnerabilities in the compiled enclave. Mitigation of these vulnerabilities is not as simple as ensuring that pointers are outside enclave memory. In fact, we demonstrate that state-of-the-art mitigation techniques such as Intel's edger8r, Microsoft's "deep copy marshalling", or even memory-safe languages like Rust fail to fully eliminate this attack surface. Our analysis reveals 35 enclave interface sanitization vulnerabilities in 8 major open-source shielding frameworks for Intel SGX, RISC-V, and Sancus TEEs. We practically exploit these vulnerabilities in several attack scenarios to leak secret keys from the enclave or enable remote code reuse. We have responsibly disclosed our findings, leading to 5 designated CVE records and numerous security patches in the vulnerable open-source projects, including the Intel SGX-SDK, Microsoft Open Enclave, Google Asylo, and the Rust compiler.

  • CCS - A Tale of Two Worlds: Assessing the Vulnerability of Enclave Shielding Runtimes
    Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019
    Co-Authors: Jo Van Bulck, David Oswald, Eduard Marin, Abdulla Aldoseri, Flavio D Garcia, Frank Piessens
    Abstract:

    This paper analyzes the vulnerability space arising in Trusted Execution Environments (TEEs) when interfacing a trusted enclave application with untrusted, potentially malicious code. Considerable research and industry effort has gone into developing TEE runtime libraries with the purpose of transparently shielding enclave application code from an adversarial environment. However, our analysis reveals that shielding requirements are generally not well-understood in real-world TEE runtime implementations. We expose several sanitization vulnerabilities at the level of the application binary interface (ABI) and the application Programming interface (API) that can lead to exploitable memory safety and side-channel vulnerabilities in the compiled enclave. Mitigation of these vulnerabilities is not as simple as ensuring that pointers are outside enclave memory. In fact, we demonstrate that state-of-the-art mitigation techniques such as Intel's edger8r, Microsoft's "deep copy marshalling", or even memory-safe languages like Rust fail to fully eliminate this attack surface. Our analysis reveals 35 enclave interface sanitization vulnerabilities in 8 major open-source shielding frameworks for Intel SGX, RISC-V, and Sancus TEEs. We practically exploit these vulnerabilities in several attack scenarios to leak secret keys from the enclave or enable remote code reuse. We have responsibly disclosed our findings, leading to 5 designated CVE records and numerous security patches in the vulnerable open-source projects, including the Intel SGX-SDK, Microsoft Open Enclave, Google Asylo, and the Rust compiler.

Xavier Leroy - One of the best experts on this subject based on the ideXlab platform.

  • Formal verification of object layout for C++ multiple inheritance
    2011
    Co-Authors: Tahina Ramananandro, Gabriel Dos Reis, Xavier Leroy
    Abstract:

    Object layout - the concrete in-memory representation of objects - raises many delicate issues in the case of the C++ language, owing in particular to multiple inheritance, C compatibility and separate compilation. This paper formalizes a family of C++ object layout scheme and mechanically proves their correctness against the operational semantics for multiple inheritance of Wasserrab et al. This formalization is flexible enough to account for space-saving techniques such as empty base class optimization and tail-padding optimization. As an application, we obtain the first formal correctness proofs for realistic, optimized object layout algorithms, including one based on the popular GNU C++ application binary interface. This work provides semantic foundations to discover and justify new layout optimizations; it is also a first step towards the verification of a C++ compiler front-end.

  • Formal verification of object layout for c++ multiple inheritance
    ACM SIGPLAN Notices, 2011
    Co-Authors: Tahina Ramananandro, Gabriel Dos Reis, Xavier Leroy
    Abstract:

    Object layout - the concrete in-memory representation of objects - raises many delicate issues in the case of the C++ language, owing in particular to multiple inheritance, C compatibility and separate compilation. This paper formalizes a family of C++ object layout schemes and mechanically proves their correctness against the operational semantics for multiple inheritance of Wasserrab et al. This formalization is flexible enough to account for space-saving techniques such as empty base class optimization and tail-padding optimization. As an application, we obtain the first formal correctness proofs for realistic, optimized object layout algorithms, including one based on the popular "common vendor" Itanium C++ application binary interface. This work provides semantic foundations to discover and justify new layout optimizations; it is also a first step towards the verification of a C++ compiler front-end.

  • POPL - Formal verification of object layout for c++ multiple inheritance
    Proceedings of the 38th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages - POPL '11, 2011
    Co-Authors: Tahina Ramananandro, Gabriel Dos Reis, Xavier Leroy
    Abstract:

    Object layout - the concrete in-memory representation of objects - raises many delicate issues in the case of the C++ language, owing in particular to multiple inheritance, C compatibility and separate compilation. This paper formalizes a family of C++ object layout schemes and mechanically proves their correctness against the operational semantics for multiple inheritance of Wasserrab et al. This formalization is flexible enough to account for space-saving techniques such as empty base class optimization and tail-padding optimization. As an application, we obtain the first formal correctness proofs for realistic, optimized object layout algorithms, including one based on the popular "common vendor" Itanium C++ application binary interface. This work provides semantic foundations to discover and justify new layout optimizations; it is also a first step towards the verification of a C++ compiler front-end.

Richard Earnshaw - One of the best experts on this subject based on the ideXlab platform.

Jim Sukha - One of the best experts on this subject based on the ideXlab platform.

  • a compiler runtime application binary interface for pipe while loops
    ACM Symposium on Parallel Algorithms and Architectures, 2015
    Co-Authors: Jim Sukha
    Abstract:

    Pipe-while loops have been proposed as a language construct for expressing pipeline parallelism in task-parallel languages. However, this loop construct has only been prototyped in research systems that lack compiler support. We demonstrate how to extend Intel® Cilk™ Plus, a production-quality task-parallel language, to implement pipe-while loops. We propose an extension to the compiler-runtime application binary interface (ABI) of Cilk Plus to support pipe-while loops. This extension maintains compatibility with existing language constructs and existing Cilk Plus binaries. We validate this ABI by prototyping the required runtime modifications and simulating the required front-end compiler transformations using preprocessor macros and C++ lambda functions.

  • SPAA - Brief Announcement: A Compiler-Runtime application binary interface for Pipe-While Loops
    Proceedings of the 27th ACM symposium on Parallelism in Algorithms and Architectures, 2015
    Co-Authors: Jim Sukha
    Abstract:

    Pipe-while loops have been proposed as a language construct for expressing pipeline parallelism in task-parallel languages. However, this loop construct has only been prototyped in research systems that lack compiler support. We demonstrate how to extend Intel® Cilk™ Plus, a production-quality task-parallel language, to implement pipe-while loops. We propose an extension to the compiler-runtime application binary interface (ABI) of Cilk Plus to support pipe-while loops. This extension maintains compatibility with existing language constructs and existing Cilk Plus binaries. We validate this ABI by prototyping the required runtime modifications and simulating the required front-end compiler transformations using preprocessor macros and C++ lambda functions.

Jo Van Bulck - One of the best experts on this subject based on the ideXlab platform.

  • a tale of two worlds assessing the vulnerability of enclave shielding runtimes
    Computer and Communications Security, 2019
    Co-Authors: Jo Van Bulck, David Oswald, Eduard Marin, Abdulla Aldoseri, Flavio D Garcia, Frank Piessens
    Abstract:

    This paper analyzes the vulnerability space arising in Trusted Execution Environments (TEEs) when interfacing a trusted enclave application with untrusted, potentially malicious code. Considerable research and industry effort has gone into developing TEE runtime libraries with the purpose of transparently shielding enclave application code from an adversarial environment. However, our analysis reveals that shielding requirements are generally not well-understood in real-world TEE runtime implementations. We expose several sanitization vulnerabilities at the level of the application binary interface (ABI) and the application Programming interface (API) that can lead to exploitable memory safety and side-channel vulnerabilities in the compiled enclave. Mitigation of these vulnerabilities is not as simple as ensuring that pointers are outside enclave memory. In fact, we demonstrate that state-of-the-art mitigation techniques such as Intel's edger8r, Microsoft's "deep copy marshalling", or even memory-safe languages like Rust fail to fully eliminate this attack surface. Our analysis reveals 35 enclave interface sanitization vulnerabilities in 8 major open-source shielding frameworks for Intel SGX, RISC-V, and Sancus TEEs. We practically exploit these vulnerabilities in several attack scenarios to leak secret keys from the enclave or enable remote code reuse. We have responsibly disclosed our findings, leading to 5 designated CVE records and numerous security patches in the vulnerable open-source projects, including the Intel SGX-SDK, Microsoft Open Enclave, Google Asylo, and the Rust compiler.

  • CCS - A Tale of Two Worlds: Assessing the Vulnerability of Enclave Shielding Runtimes
    Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, 2019
    Co-Authors: Jo Van Bulck, David Oswald, Eduard Marin, Abdulla Aldoseri, Flavio D Garcia, Frank Piessens
    Abstract:

    This paper analyzes the vulnerability space arising in Trusted Execution Environments (TEEs) when interfacing a trusted enclave application with untrusted, potentially malicious code. Considerable research and industry effort has gone into developing TEE runtime libraries with the purpose of transparently shielding enclave application code from an adversarial environment. However, our analysis reveals that shielding requirements are generally not well-understood in real-world TEE runtime implementations. We expose several sanitization vulnerabilities at the level of the application binary interface (ABI) and the application Programming interface (API) that can lead to exploitable memory safety and side-channel vulnerabilities in the compiled enclave. Mitigation of these vulnerabilities is not as simple as ensuring that pointers are outside enclave memory. In fact, we demonstrate that state-of-the-art mitigation techniques such as Intel's edger8r, Microsoft's "deep copy marshalling", or even memory-safe languages like Rust fail to fully eliminate this attack surface. Our analysis reveals 35 enclave interface sanitization vulnerabilities in 8 major open-source shielding frameworks for Intel SGX, RISC-V, and Sancus TEEs. We practically exploit these vulnerabilities in several attack scenarios to leak secret keys from the enclave or enable remote code reuse. We have responsibly disclosed our findings, leading to 5 designated CVE records and numerous security patches in the vulnerable open-source projects, including the Intel SGX-SDK, Microsoft Open Enclave, Google Asylo, and the Rust compiler.