PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hardware Security: CHERI Capabilities In Depth.

bugpwn.com | blog | #memory-safety | #hardware-security | #cheri | #morello | #cheriot | #cheribsd
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CHERI (Capability Hardware Enhanced RISC Instructions) : définition, anatomie des capabilities, implémentations concrètes (Morello, CHERIoT), alliances industrielles, threat model et PoCs pratiques sur CheriBSD.
Published
Collected

Related coverage

blog · bugpwn.com
CheriBSD & QEMU CHERI Technical Guide.
Guide technique : construire CheriBSD et QEMU CHERI depuis les sources, corriger les erreurs de compilation réelles, démarrer un système purecap et exécuter 5 PoCs capability-aware.
blog · bughunters.google.com
Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · blog.trailofbits.com
A “proof” of Fermat’s Last Theorem that fits the margin
Trail of Bits found a Lean ≤4.33.1 bug: String.Pos.Raw.extract returns a full string where its spec says empty — enough to 'prove' Fermat's Last Theorem. Not a soundness flaw; fixed in 4.34.0-rc1.
blog · wiz.io
Cloud-native Security for your Windows environment: Announcing the Wiz Runtime Sensor for Windows
The Wiz Runtime Sensor for Windows reaches GA, bringing real-time detection to Windows VMs and Kubernetes nodes via a minimal kernel footprint and memory-safe Rust design that avoids crashes.
blog · guysrd.github.io
The futex READ_ONCE
A missing READ_ONCE in futex requeue_pi_wake_futex creates a one-instruction race letting the requeuer dereference a dead stack frame, giving a controlled 8-byte addition from unprivileged userspace.
blog · guysrd.github.io
The epoll uaf
Nicholas Carlini's epoll use-after-free in fs/eventpoll.c let RCU walkers race kfree() for a constrained write into a freed eventpoll; his Pixel 10 exploitation attempts fell short.
Back