On Kernel's Safety in the Spectre Era

ABSTRACT

Address Space Layout Randomization (ASLR) is a widely adopted defense mechanism designed to mitigate memory corruption attacks by randomizing the memory locations of critical software components. Its theoretical effectiveness has been formally established in a shared-memory model by Abadi et al. (2010), relying on specific assumptions about victim programs. However, in practice, sophisticated attacks—such as Blindside (2020)—leverage speculative execution and side-channel techniques to bypass ASLR, undermining its protective capabilities and enabling memory corruption.

In this talk, I will examine these emerging threats, focusing on potential strategies and mitigation techniques aimed at reinforcing kernel security in the Spectre era. Finally, I will discuss which kernel transformations would lead in theory to recover kernel safety for an attacker model featuring speculative execution and side-channel capabilities.

BIOGRAPHY

Tamara Rezk is a Research Director at Inria and a part-time lecturer at Université Côte d’Azur, Sophia Antipolis, France. Since 2023, she has also been a Guest Professor at Chalmers University of Technology in Gothenburg, Sweden. At Inria, she leads the SPLiTS team, which focuses on developing security analyses and defenses. Her main research interests lie in system security. She has supervised several Ph.D. students on topics such as static and dynamic security analyses, web security, formal methods for security, and provable cryptography. Currently, her work emphasizes designing defenses and principled methods to address microarchitectural attacks and web application vulnerabilities. Rezk has served on numerous program committees, including those of the top-4 security conferences. She has also chaired several events, including IEEE CSF in 2023 and 2024, and is currently the Formal Methods and Programming Languages track chair for ACM CCS 2025.

Hosted by:

Dave Naumann