Vasileios Kemerlis<p>📢 Honored to return to Yale University last week to speak at the Department of Computer Science colloquium on Operating Systems security -- exactly 10 years after my first talk there on the same topic!</p><p>In this "tin anniversary" edition, I reflected on how OS kernel exploitation and defense have evolved over the past decade, and shared highlights from some of our recent work in the field over the last five years:</p><p>✳️ xMP (IEEE S&P 2020: 📄 <a href="https://cs.brown.edu/~vpk/papers/xmp.sp20.pdf" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">cs.brown.edu/~vpk/papers/xmp.s</span><span class="invisible">p20.pdf</span></a>, 💾 <a href="https://github.com/virtsec/xmp" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/virtsec/xmp</span><span class="invisible"></span></a>) — Selective intra-kernel memory isolation using hardware-assisted virtualization.</p><p>✳️ SafeSLAB (ACM CCS 2024: 📄 <a href="https://cs.brown.edu/~vpk/papers/safeslab.ccs24.pdf" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">cs.brown.edu/~vpk/papers/safes</span><span class="invisible">lab.ccs24.pdf</span></a>, 💾 <a href="https://github.com/tum-itsec/safeslab" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/tum-itsec/safeslab</span><span class="invisible"></span></a>) — Kernel heap hardening through memory tagging.</p><p>✳️ EPF (USENIX ATC 2023: 📄 <a href="https://cs.brown.edu/~vpk/papers/epf.atc23.pdf" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">cs.brown.edu/~vpk/papers/epf.a</span><span class="invisible">tc23.pdf</span></a>, 💾 <a href="https://gitlab.com/brown-ssl/epf" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">gitlab.com/brown-ssl/epf</span><span class="invisible"></span></a>) — Exploiting the (e)BPF sub-system for bypassing modern protections and ways to fix this.</p><p>(Joint work with <span class="h-card" translate="no"><a href="https://infosec.exchange/@mikepo" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>mikepo</span></a></span>, Marius Momeu, Vaggelis Atlidakis, <span class="h-card" translate="no"><a href="https://mastodon.social/@dijin" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>dijin</span></a></span>, and Sergej Proskurin.)</p><p>If this area of research interests you, you might also find our recent work on BeeBox (strengthening eBPF against transient execution attacks, USENIX Security 2024: 📄 <a href="https://cs.brown.edu/~vpk/papers/beebox.sec24.pdf" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">cs.brown.edu/~vpk/papers/beebo</span><span class="invisible">x.sec24.pdf</span></a>, 💾 <a href="https://gitlab.com/brown-ssl/beebox" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">gitlab.com/brown-ssl/beebox</span><span class="invisible"></span></a>) and IUBIK (leveraging memory tagging and pointer authentication to isolate attacker-controlled data in kernel space, to appear in IEEE S&P 2025) worth a look.</p><p>It was a real pleasure catching up with friends, colleagues, and students. And with the spring weather fully cooperating, I couldn't resist snapping a few photos of Yale's beautiful campus in the early morning light.</p><p>Thank you to my host Charalampos Papamanthou and the Yale CS department for the warm welcome and thoughtful discussion!</p><p><a href="https://infosec.exchange/tags/xmp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>xmp</span></a> <a href="https://infosec.exchange/tags/safeslab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>safeslab</span></a> <a href="https://infosec.exchange/tags/epf" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>epf</span></a> <a href="https://infosec.exchange/tags/brownssl" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>brownssl</span></a></p>