Firefly: High-Performance Transient Execution Attack Defenses for In-Kernel Sandboxes

Authors: Luis Gerhorst (Friedrich-Alexander-Universität Erlangen-Nürnberg, Ruhr-Universität Bochum), Henriette Herzog (Ruhr-Universität Bochum), Benedict Herzog (Ruhr-Universität Bochum), Peter Wägemann (Friedrich-Alexander-Universität Erlangen-Nürnberg), Rüdiger Kapitza (Friedrich-Alexander-Universität Erlangen-Nürnberg), Timo Hönig (Ruhr-Universität Bochum)

Safe operating system kernel extensions, as implemented by Linux eBPF, enable improved application performance, kernel observability, and system security. To extend these benefits beyond privileged applications, the kernel must ensure that eBPF programs cannot escape their in-kernel sandbox through transient execution attacks, such as Spectre. However, all existing defenses for eBPF (i.e., upstream eBPF, VeriFence, BeeBox, and HIVE) lack at least one of three properties an in-kernel sandbox requires: (1) low overhead, (2) portability, and (3) address-space sharing. This raises the systems design question of whether in-kernel sandboxes must give up one of these properties to defend against transient execution attacks.

To answer this question, we present Firefly, a verifier-based defense for eBPF that simultaneously achieves these three properties through co-design of verifier logic, helper interfaces, and code generation. At its core is a speculation-aware verifier that unifies Spectre-PHT (v1) and Spectre-STL (v4) handling while using a refined constant-time leakage model that also protects physical-layout information. Unlike BeeBox and HIVE, Firefly does not require ARM64-specific hardware features, address-space separation, or driver-specific optimizations. On x64, Firefly matches the most performant, but use-case–specific, BeeBox variant, whereas generic state-of-the-art alternatives add 71% to 151% for Meta's Katran load balancer. Firefly, in contrast, only induces 6% to 26% eBPF execution-time overhead.

Towards a Physical Machine Model for Cyber-Physical Systems

Authors: Martin Richter (TU Chemnitz), Matthias Werner (TU Chemnitz)

Cyber-Physical Systems (CPS) integrate the digital and physical worlds through sensors and actuators. Applications for such systems frequently aim to achieve a physical objective (e.g., demolishing a building in Construction Robotics or storing packages in Smart Warehouses). These examples show that physical objectives frequently are not limited to controlling devices. Rather, they may concern the devices' surroundings (e.g., buildings and packages). Typically, such CPS applications are built with programming abstractions that focus on the digital system while treating devices as system boundaries. For example, swarm-based approaches focus on coordinating multiple devices rather than how they influence their surroundings. Therefore, reasoning about the devices' influence on their surroundings and managing actuators to achieve the physical goal is left to the application. We argue that providing generic application support for CPS applications with physical objectives requires programming abstractions that provide a systemic view of the physical system (i.e., devices and their surroundings). We provide a new perspective on CPS by viewing the physical system as the executing machine in CPS (i.e., the physical machine). This perspective provides a systemic view that incorporates devices and their surroundings. Executing an application on the physical machine refers to executing actuator actions that may influence the devices' surroundings. Reasoning about this requires a physical machine model that describes the physical consequences of executing an application. We choose Hybrid Bond Graphs as a formalism for describing this machine model because of their energy-based physical semantics and their capability to capture variable system structure. Based on this machine model, we provide a low-level declarative programming approach that enables describing physical application objectives and deriving the required actuator actions to achieve them. This programming approach takes the form of Hybrid Control Bond Graphs, our extension of Hybrid Bond Graphs. They enable developers to describe the physical application objectives explicitly while allowing transparent derivation of the required actuator actions to achieve them. We implement the machine model and programming approach through a prototypical compiler that heuristically translates low-level declarative programs into actuator actions that steer the physical system toward the application objective.

CCX: Enabling Unmodified Intel SGX Applications on Arm CCA

Authors: Matti Schulze (Friedrich-Alexander-Universität Erlangen-Nürnberg), Thorsten Holz (Max Planck Institute for Security and Privacy), Felix Freiling (Friedrich-Alexander-Universität Erlangen-Nürnberg)

While novel confidential computing technologies such as Intel TDX, AMD SEV, and Arm CCA have emerged, Intel SGX remains widely used for enclave-based applications in cloud environments due to its minimal trust boundaries. For example, SGX’s applications include confidential cloud services, privacy-preserving communication, secure payment processing, and privacy-focused advertising. With the growing adoption of Arm CPUs in cloud systems, however, existing SGX applications face a significant portability challenge: they are tightly coupled to SGX-specific APIs and execution semantics that are generally unavailable under Arm.

In this talk, we present the design and implementation of CCX, a framework that enables existing SGX applications to run on Arm CCA without modifying their source code. To this end, CCX implements the functionalities required to run SGX enclaves within Arm CCA firmware, adapting SGX abstractions to CCA's architecture. In general, CCX relies on CCA's granule protection tables (GPTs) to provide SGX-comparable hardware protections for enclaves. The CCX firmware additions contain redesigned versions of all SGX-specific x64 instructions, now targeting the Arm platform, that manage enclave protection via these GPTs, as well as enclave organization, scheduling, and execution. To enable SGX enclaves to be transparently executed via CCX, we adapt all x64-specific aspects of the widely used SGX toolchain, which includes the SGX SDK and the Linux SGX driver, routing invocations of SGX-specific instructions to the CCA firmware. With this, CCX provides full compatibility with existing SGX programs, requiring only a recompilation. Furthermore, because the GPTs that provide enclave protection under CCX are more flexible than SGX's hardware protection mechanisms, CCX can address various performance bottlenecks in SGX.

We implemented a CCX prototype on both the QEMU emulator and a Nitrogen8M development board to assess its performance. Our evaluation shows that CCX can execute existing SGX applications without requiring source code changes, while providing security guarantees comparable to Intel SGX and delivering performance improvements in our evaluated settings.

Rearchitecting the VMM for Confidential Virtual Machines

Authors: Masanori Misono (Technical University of Munich)

Confidential Virtual Machines (CVMs) provide Trusted Execution Environments (TEEs) at the VM granularity, offering a more flexible alternative to traditional application-level TEEs such as Intel SGX. Driven by increasing concerns over security threats, including insider attacks, and regulatory privacy requirements (e.g., GDPR), CVMs provide the foundation of confidential computing in the cloud. CVMs exclude the virtual machine monitor (VMM) from the Trusted Computing Base (TCB): the VMM is assumed to be malicious or compromised, and the trusted platform (hardware and its firmware) enforces access control, memory encryption, and integrity protection to prevent any unauthorized access. Major CPU vendors ship CVM technologies, including Intel TDX, AMD SEV-SNP, and ARM CCA. Moreover, the leading cloud providers offer CVM as a service.

Unfortunately, existing CVM technologies still struggle to deliver their guarantee: Many vulnerabilities break the confidentiality or integrity of CVMs, raising serious questions about their real-world deployments. To enhance CVM security, most prior work focuses on hardening guest software, employing in-CVM security monitors, and developing specialized OSes for CVMs to reduce the TCB or integrate side-channel mitigations. However, some attacks are inherently impossible to fully mitigate solely from within the CVM. While hardware vendors provide firmware updates and new hardware features to mitigate these vulnerabilities, they take time to develop and deploy, and may not be available for legacy hardware.

Our study of 26 attacks presented at security and systems conferences revealed the root cause of these vulnerabilities: the VMM is retaining excessive control over CVMs. Specifically, the VMM schedules vCPUs, delivers interrupts, manages memory, and shares physical resources with CVMs. Attackers exploit these vulnerabilities to force the CVM into deterministic or unexpected states, subverting control flow, or leak data from residual information in shared resources. This highlights a fundamental paradox: in practice, a privileged layer cannot be assumed completely untrusted without breaking essential management functions. Therefore, we must rethink the system architecture for CVMs to restrict the VMM's capabilities by design.

One could extend the trusted firmware to limit the VMM's capabilities. However, this would require modifying vendor-controlled firmware or even hardware, which might be infeasible. Worse, given the heterogeneity of CVM mechanisms, it would also need to be repeated for every hardware platform. Instead, we opt for a more flexible approach: we introduce a VMM security monitor, an additional software-based security enforcement layer between the VMM and the trusted firmware/hardware.

In this talk, we present cVisor, a comprehensive realization of a secure-by-design CVM architecture. cVisor design is guided by the following principles. cVisor interposes on critical VMM operations through hardware-enforced virtualization, constraining the VMM's control over CVMs regardless of its behavior. It adopts a parapass-through architecture and leverages paravirtualization to enable secure and efficient CVM management while keeping cVisor TCB small. A customizable security policy framework lets users tailor its operation to their specific needs, and a novel attestation protocol ensures end-to-end integrity.

We present the security analysis of cVisor in depth, showing how it defends against reported attacks on AMD SEV-SNP and Intel TDX, and evaluate its performance to asses both effectiveness and practicality.

Trust Nothing: RTOS Security without Run-Time Software TCB

Authors: Eric Ackermann (CISPA Helmholtz Center for Information Security), Sven Bugiel (CISPA Helmholtz Center for Information Security)

Embedded devices face an ever-expanding threat landscape: vulnerabilities in application software, operating system kernels, and peripherals threaten the embedded device integrity. Existing computer-architectural defenses fully consider at most two of these threat vectors in their security model.

This work aims at addressing this gap using a novel capability architecture. To this end, we combine a token capability approach suitable for building an untrusted operating system with protection against malicious devices without requiring hardware changes to peripherals.

First, we develop and evaluate a full FPGA implementation of our capability architecture around legacy hardware components. Further, we present a soft real-time operating system based on Zephyr that has no run-time software TCB. To this end, we disaggregate Zephyr’s subsystems into small, mutually isolated components. All subsystems that exist at run time, including scheduler, allocator and DMA drivers, and all peripherals are fully untrusted.

Our results show that our approach has a high overhead in chip area, code size and load time. Furthermore, overheads in benchmarks that comprise frequent transitions between distrusting subsystems are high. However, our sophisticated caching architecture allows us to achieve compute performance indistinguishable from the baseline system.

Our implementation leaves room for improvement. We will address shortcomings of the current prototype system in future work. However, we believe that our work offers a foundation for more rigorous security-by-design in tomorrow’s security-critical embedded devices and can serve as a foundation for future research in secure operating systems and computer architecture.

This talk is based on our paper of the same name at the 2026 USENIX Security Symposium.

WarpGuard: Towards Control-Flow Attestation for Heterogeneous CPU-GPU Execution

Authors: Christian Lindenmeier (NVIDIA), Meni Orenbach (NVIDIA), Amro Awad (University of Oxford), Fabian Schwarz (NVIDIA), Fritz Alder (NVIDIA), Ahmad Atamli (NVIDIA)

Modern compute workloads increasingly rely on heterogeneous processor combinations: a CPU host orchestrates the overall execution while a GPU accelerator performs data-parallel computation, a pattern particularly prevalent in embedded and IoT deployments where integrated CPU-GPU platforms enable real-time AI inference at low power budgets. For CPU programs, Control-Flow Attestation (CFA) allows a remote verifier to cryptographically confirm that a prover executed only control-flow paths permitted by its control-flow graph, enabling detection of code-reuse attacks such as ROP. The GPU side, however, has received very little attention: existing GPU integrity approaches verify a kernel binary only at load time, while recent work has demonstrated GPU stack overflows enabling GPU-native ROP that is invisible to such static checks. Moreover, attesting the GPU side in isolation is insufficient: an attacker who can influence the CPU-GPU dispatch boundary can substitute a GPU kernel for another benign one, manipulate the kernel image before dispatch, or alter the launch configuration — none of which leaves a trace in either processor's attestation record alone.

In this talk, we present the design and implementation of WarpGuard, the first CFA framework that jointly attests heterogeneous CPU-GPU execution. WarpGuard traces the control flow of both the CPU host application and all dispatched GPU kernels, and correlates each GPU execution with the specific GPU callsite on the CPU thread that triggered it. To this end, WarpGuard's verifier operates on a composite control-flow graph that unifies the CPU CFG with per-kernel GPU CFGs, linked at dispatch points via launchsite policies. On the GPU side, WarpGuard exploits the SIMT execution model to trace at warp granularity: since all active threads in a non-diverged warp execute the same instruction, a single trace entry per warp faithfully captures the warp's control flow at a fraction of the per-thread cost. At the CPU-GPU boundary, WarpGuard records each kernel dispatch, binds it to a content-based kernel identity, and enforces per-callsite launchsite policies specifying which GPU kernels are authorized to execute at each dispatch site and under which launch configurations. Because GPUs expose no hardware tracing facilities comparable to Intel PT or ARM CoreSight, WarpGuard realizes tracing entirely through dynamic binary instrumentation, requiring no source code or hardware modifications and supporting proprietary AI libraries.

We implemented a WarpGuard prototype on an NVIDIA Jetson Orin Nano using the instrumentation frameworks DynamoRIO and NVBit to assess its security and performance. Our evaluation shows that WarpGuard detects GPU-side control-flow hijacking — including an end-to-end reproduction of the GPU ROP attack of recent work — as well as cross-boundary kernel substitution, manipulation, and launch-configuration attacks. Across microbenchmarks, the SPECaccel benchmark suite, and eight TensorRT inference workloads, WarpGuard incurs moderate overheads, suggesting practicality for embedded safety-critical settings.

BMWE Mod2SDV / SADE - Safe and Secure Modular Architectures for the Next-Generation Vehicle

Authors: Isabella Stilkerich (Schaeffler Technologies)

Beyond their core functionality, as defined by functional requirements, systems must also meet various quality expectations – those anticipated by customers, mandated by regulators, and dictated by the physical environment. Achieving these qualities is driven by decisions at the architectural level. Architects use both qualitative and quantitative analysis to estimate and verify the outcomes of their design decisions.

This session examines how reliability in software-defined vehicle systems is determined at the architectural level, particularly when integrating heterogeneous software stacks such as AUTOSAR Classic, adaptive systems, and Eclipse S-CORE. The discussion highlights challenges in zonal architectures, where distributed ECUs and central high-performance compute units must coordinate across different execution models and resource constraints.

A key focus is fault tolerance across ECUs. The proposed approach enables takeover of critical functionality from a failed ECU to another node using service-oriented communication protocols such as SOME/IP. The system transitions the failing ECU into a fail-silent mode, starts a backup instance of the functionality, and reconnects it to the system. Earlier implementations based on hypervisors are extended to container-based recovery for reduced resource overhead and improved flexibility in S-CORE environments.

In addition, also quantitative, formal analyses of software architecture qualities play an important role. Architecture qualities have their foundation on topics such as coupling, data flow, real-time behavior and stack memory usage. I will illustrate how these characteristics are rooted in ISO 25010’s quality model and how the model supports compliance with software engineering base practices, as well as safety and security standards. Static architectural and code analysis based on abstract interpretation, is presented as a method to verify these architectural qualities.

The activities presented are currently being explored in the Software Defined Solutions Research Cluster at Schaeffler Technologies and are a part of the BMWE funded Mod2SDV project. The Systems Software Group at TU Dortmund, the Department of Computer Science 4 at FAU Erlangen-Nuremberg, AbsInt Angewandte Informatik GmbH and the Eclipse Foundation are Schaeffler's cooperation partners in Mod2SDV / SADE.

From Stochastic Parrots to Industrialized Bug Finding -- The Impact of LLMs on Linux Distributions

Authors: Björn Döbel (AWS)

When Claude Code streamlined agentic coding in 2025, it was often smiled (or frowned) upon. While it simplified the act of writing code and the testing and debugging of simple programs, it also demonstrated which questions were yet unsolved - who is going to review all the code? How are we going to stay on top of patching in a world where we find new bugs by the hour? How can we trust the output of a tool we cannot even debug? Or how can we at least prevent it from deleting all our email?

While we are still searching for answers to these questions, the world has moved on and LLM-based bug finding took off in 2026. Anthropic positioned their latest Mythos model as being so good at exploitation that they could only make it available to a select group of security researchers via Project Glasswing. Firefox claims to have fixed 400+ security issues in a month because of Mythos findings. The Linux kernel became under scrutiny for a series of privilege escalation bugs that had been lingering for years and were now all found at once. And just as the dust had settled, news broke that OpenAI's latest model had broken out of the sandbox at Hugging Face.

In this talk I'm going to explore how LLM-assisted bugfinding has changed the inner workings of open source and specifically those of a Linux distribution and how systems engineering and research is still relevant in the age of AI.

TEEM³: Core-Independent and Cooperating Trusted Execution Environments

Authors: Nils Asmussen (Barkhausen Institut)

Trusted Execution Environments (TEEs) enable secure code execution on machines that are not fully trusted by the user who runs the workload. However, existing TEE solutions mostly target CPUs and are typically tied to one specific instruction set architecture. Although some accelerators also provide support for TEEs, this leads to multiple, different TEE implementations on the same system, increasing its complexity and trusted computing base (TCB). This challenge becomes particularly apparent when workloads span heterogeneous processing units, because the diversity of TEE implementations complicates the creation of secure communication channels between the individual TEEs.

In this talk, I will present TEEM³, a trusted execution architecture with discrete, out-of-core enforcement, which is core-independent and better-suited to heterogeneous systems than existing approaches. We build upon M³ and extend both the hardware platform and operating system (OS). On the OS side, we add a root of trust (RoT) for remote attestation and a unikernel-like library for TEEs. On the hardware side, we add two lightweight isolation mechanisms to protect both TEEs and the RoT from other components in the system. Furthermore, TEEM³ inherits uniform communication channels from M³ and protects them to support communicating groups of TEEs. We show in the evaluation that our approach has low performance overhead, modest additional hardware costs, and reduces the hardware TCB by a factor of 1.8 and the software TCB by a factor of 3.42.

Isolation for Cyber-Physical Systems with Linux Confinement Mechanisms

Authors: Nils Scheidweiler (Friedrich Schiller University Jena), Eric Wintzler (Friedrich Schiller University Jena)

Cyber-physical systems (CPSs) combine physical and computational capabilities. Such systems are prevalent in our modern world, ranging from airplanes to autonomous drones. A CPS reads data from its sensors, performs computations, and interacts with its physical environment by controlling actuators. For CPSs, non-functional properties such as energy, time, security, and robustness (ETSR) are as important as functional correctness. The deployment of CPSs on heterogeneous and parallel computing platforms faces complex challenges, such as solving scheduling and mapping problems to meet ETSR constraints and objectives.

We propose Lemming, our novel runtime system for CPSs on Linux, to tackle these challenges. Applications for Lemming are written in the TeamPlay coordination language. Following the idea of exogenous coordination, TeamPlay separates computation from coordination. Furthermore, TeamPlay makes ETSR constraints and objectives first-class citizens of the software design process. An application is modeled as a directed acyclic graph (DAG) of stateless components, where tasks (vertices) implement application-specific code and channels (edges) define both timing dependencies and stream-based data exchange.

Lemming serves as a highly configurable toolbox, making it adaptable to many real-world applications. Security deserves a closer look here, since a CPS may integrate third-party libraries or proprietary code. A fault or compromise through malicious or vulnerable code can have harmful consequences. Therefore, Lemming separates the application into security zones that are isolated from one another. To enforce this isolation, Lemming relies on existing Linux Security Modules such as Landlock.

Moreover, the TeamPlay and Lemming toolchain removes the need to write a security policy by hand. As the DAG already lists every legitimate interaction between components, privilege becomes a derived property of a component's position in the graph. What the graph does not describe must be declared in the TeamPlay specification: the paths to the devices for sensors and actuators, the required system calls, and the hardware resources granted to each zone, such as memory. From the graph and these declarations, our toolchain derives a per-zone policy and installs it on the target system.

The Gamekernel: Unleashing eBPF For Extensibility and Prototyping

Authors: Nicholas Gordon (Barkhausen Institut)

The eBPF subsystem in the Linux kernel couples a just-in-time (JIT) compiler with a program verifier to allow safe extensions to the kernel. However, the subsystem's architecture strongly restricts programs, currently requiring developers to add specific "whitelist" points in the kernel code before eBPF programs can be run or call kernel functions. Further, the eBPF verifier is difficult to work with, making debugging eBPF programs frustrating despite several attempts to improve it ergonomically. Interestingly, the underlying JIT compiler itself is not sandboxed, hinting at significant opportunities if it were less restricted by the verifier. Programs in such a runtime could implement drivers, eliminate kernel-userspace transitions by "downloading" logic into the kernel, or live-updating code without rebuilds or reboots, among others. We present the Gamekernel concept, a kernel with a general-purpose JIT compiler that enables exactly this kind of fast prototyping and flexibile extensibility. By design, a Gamekernel exposes general mechanisms or default functionality written in a low-level, performant language, while the "content" is written in another, higher-level scripting language which overrides or extends the aforementioned defaults. We also discuss a first implementation of the Gamekernel, allowing users to write eBPF programs in Lua for the Linux kernel. Our prototype has full access to kernel data and functions, yielding many possibilities to extend, replace, and experiment with Linux functionality, yielding both speedups as well as sidestepping Linux's famously complex code and build infrastructures.

Towards a Self-Attesting Key Broker for Confidential Containers

Authors: Yannes Tallowitz (TH Nürnberg), Hans Löhr (TH Nürnberg)

Confidential Containers only release secrets after a workload has been successfully attested. The Key Broker Service (KBS) itself is not attested and must still be regarded as trustworthy, which is a problem in a Software as a Service (SaaS) scenario where its operator is a third party. However, simply attesting the broker is not sufficient as long as its operator can still set the reference values used. This work introduces the concept of a self-attesting KBS that combines verifiable reference values, the binding of the runtime state via report_data, an attestation of the broker during provisioning, and operator-independent protection of the stored secrets. Measurements on Secure Encrypted Virtualization – Secure Nested Paging (SEV-SNP) hardware reproduce the launch measurement and show that the broker’s release policy can be changed during operation without leaving any trace. The presented concept does not completely eliminate trust, but it reduces it to a smaller and independently verifiable basis.

Catch Me If You Can - JIT-based Continuous Re-randomization of the Kernel Address-Space Layout

Authors: Paul Zinselmeyer (Ruhr-Universität Bochum), Henriette Herzog (Ruhr-Universität Bochum), Maximilian Ott (Friedrich-Alexander-Universität Erlangen-Nürnberg), Timo Hönig (Ruhr-Universität Bochum), Rüdiger Kapitza (Friedrich-Alexander-Universität Erlangen-Nürnberg)

Memory-corruption vulnerabilities, such as buffer overflows, remain one of the most prevalent classes of defects in modern systems software. The Chromium project, for example, reports that around “70 % of [their] serious security bugs are memory-safety problems” [6]. Rather than injecting new code, modern exploits often reuse code that is already present in the target. For example, in return-oriented programming (ROP) attacks, the adversary chains together short instruction sequences ending in a return, called gadgets, to synthesize arbitrary behavior. Kernel address-space layout randomization (KASLR) is a widely deployed mitigation technique for this class of exploits: by placing the kernel’s code at an unpredictable location, it hides the addresses of these gadgets from the attacker.

Most implementations, including the Linux kernel, randomize the layout once, at boot, after which it stays fixed until the next reboot. This static approach raises the bar for naive exploitation, but it does not withstand more sophisticated adversaries. Several attacks defeat KASLR by reconstructing gadget locations from information leaked through side channels or software bugs [1–3]. Once a single address is disclosed, the entire layout is effectively de-randomized for the rest of the boot.

Continuous re-randomization, which periodically relocates code at runtime, narrows the window during which a leaked address remains valid. So far, practical support has been limited to user space [7] or to isolated kernel modules [4], leaving the kernel as a whole unprotected. In this work, we leverage the just-in-time (JIT) compiler of the DOSS operating-system specialization framework [5] to enable continuous, function-level re-randomization for most of the JITTY OS kernel. The kernel code is repeatedly recompiled and relocated at runtime, so that any leaked address is invalidated before it can be used. We make the following contributions:

• A randomized code cache that governs the placement of JIT-compiled kernel functions.
• Hardening measures that keep the JIT compiler itself from becoming an exploitation vector.
• A continuous, function-level re-randomization mechanism built on top of the JIT compiler.

By leveraging the JIT compiler within the DOSS framework, we enable continuous, function-level re-randomization of the kernel code at runtime, effectively neutralizing KASLR bypass attacks that rely on leaked address information.

References

[1] Daniel Gruss, Moritz Lipp, Michael Schwarz, Richard Fellner, Clémentine Maurice, and Stefan Mangard. Kaslr is dead: Long live kaslr. In Eric Bodden, Mathias Payer, and Elias Athanasopoulos, editors, Engineering Secure Software and Systems, pages 161–176, Cham, 2017. Springer International Publishing. ISBN 978-3-319-62105-0.

[2] Yu Jin, Chunlu Wang, Pengfei Qiu, Chang Liu, Yihao Yang, Hongpei Zheng, Yongqiang Lyu, Xiaoyong Li, Gang Qu, and Dongsheng Wang. Whisper: Timing the transient execution to leak secrets and break kaslr. In Proceedings of the 61st ACM/IEEE Design Automation Conference, DAC ’24, New York, NY, USA, 2024. Association for Computing Machinery. ISBN 9798400706011. doi: 10.1145/3649329.3656213. URL doi.org/10.1145/3649329.3656213.

[3] William Liu, Joseph Ravichandran, and Mengjia Yan. Entrybleed: A universal kaslr bypass against kpti on linux. In Proceedings of the 12th International Workshop on Hardware and Architectural Support for Security and Privacy, HASP ’23, page 10–18, New York, NY, USA, 2023. Association for Computing Machinery. ISBN 9798400716232. doi: 10.1145/3623652.3623669. URL doi.org/10.1145/3623652.3623669.

[4] Ruslan Nikolaev, Hassan Nadeem, Cathlyn Stone, and Binoy Ravindran. Adelie: continuous address space layout re-randomization for linux drivers. In Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS ’22, page 483–498, New York, NY, USA, 2022. Association for Computing Machinery. ISBN 9781450392051. doi: 10.1145/3503222.3507779. URL doi.org/10.1145/3503222.3507779.

[5] Maximilian Ott, Volkmar Sieh, Wolfgang Schröder-Preikschat, Henriette Herzog, and Timo Hönig. DOSS: Dynamic operating system specialization. sys.cs.fau.de research/doss. Accessed: 01.09.2026.

[6] The Chromium Projects. Memory safety. www.chromium.org/Home/ chromium-security/memory-safety/. Accessed: 01.09.2026.

[7] David Williams-King, Graham Gobieski, Kent Williams-King, James P. Blake, Xinhao Yuan, Patrick Colp, Michelle Zheng, Vasileios P. Kemerlis, Junfeng Yang, and William Aiello. Shuffler: fast and deployable continuous code re-randomization. In Proceedings of the 12th USENIX Conference on Operating Systems Design and Implementation, OSDI’16, page 367–382, USA, 2016. USENIX Association. ISBN 9781931971331.

zBulk: Towards Automatic Compartmentalization in Rust with Zero Manual Retrofitting

Authors: Maxim Onciul (FAU)

Memory safety is a dominant driver in security and systems research. Due to its robust memory safety guarantees, Rust has emerged as a viable alternative to C/C++ for systems programming. Rust relies on static type checking and the ownership model to achieve this. However, it is not a silver bullet. The unsafe keyword enables developers to write code that the compiler cannot verify as safe. This includes direct hardware access, as well as invocations to external libraries written in unsafe languages. Vulnerabilities can result from unsafe sections, foreign code, and compiler-soundness bugs. Compartmentalization splits a program into pieces that execute in isolated, collaborating contexts. Ideally, this limits the impact of a software vulnerability to a single compartment. However, manual compartmentalization approaches are considered labor-intensive and error-prone and require in-depth system knowledge

We present zBulk, an automatic compartmentalization system that requires zero retrofitting of application code. zBulk paves the way for flexible, fine-grained compartmentalization. This high degree of automation is achieved by leveraging static type and call information and language constructs that declare mutability and ownership. We demonstrate how to design zBulk by leveraging Rustc's intermediate representations and verify our approach by fully automatically compartmentalizing a relatively small system application with a single dependency into up to eight compartments. This number can be increased for greater flexibility, as we discuss. Finally, we report overhead measurements for Intel SGX as a first isolation mechanism, with more to follow.

AI-Assisted Porting of Automotive System Software to New Hardware Architectures

Authors: Andreas Kappel (Pro2Future GmbH), Aimen Medjek (Pro2Future GmbH), Florian Riedl (Graz University of Technology), Amer Kajmaković (Pro2Future GmbH), Tobias Scheipel (Graz University of Technology), Marcel Baunach (Graz University of Technology)

The manual porting of software to new hardware is a time-consuming and error-prone process, especially in the embedded automotive domain where safety, correctness, and traceability are essential. This is even more true when the target architecture differs significantly from the origin architecture, requiring us to rethink various low-level abstractions.

This paper outlines a research vision for transitioning to an AI-assisted porting workflow that respects the unique requirements imposed by automotive standards like AUTOSAR and MISRA C. We first combine our findings on manual porting into a single workflow, which identifies six steps we aim to augment and eventually automate using Agentic Artificial Intelligence.We then propose using Knowledge Graphs to consolidate all porting-relevant information while supporting traceability, which standards such as ISO 26262 often mandate for automotive software. Finally, we outline our approach to addressing specific challenges of understanding embedded systems source code, such as assembly code and preprocessor directives.

EnclaveX: A Process-Level Approach to GPU Confidential Computing with K8s Support

Authors: Robert Schambach (TU Dresden), Quoc Do Le (STACKIT Cloud)

Large Language Models (LLMs) have rapidly proliferated, driving widespread adoption of AI applications. Most deployments rely on centralized infrastructures such as Microsoft Azure, Google Cloud, or AWS, requiring users to share sensitive models, data and training or fine-tuning code. This dependence raises significant security and privacy concerns, as cloud providers must be trusted to ensure confidentiality and integrity.

Trusted Execution Environments (TEEs) e.g., Intel SGX/TDX, AMD SEV-SNP, and ARM CCA have been introduced to mitigate these risks. More recently, NVIDIA has developed GPU TEEs (e.g., H100/B100), which attach into CVMs, forming a unified security context. However, k8s orchestrated container deployments using CVM/GPU TEEs must reserve memory, preventing any memory overbooking typically found in non-TEE container-based pod deployments. Moreover, access to the CVM implies workload access, imposing restrictions and security risks with typical orchestration privilege configurations and pod introspection tools.

In this talk, we introduce a high-level idea for CVM-based trusted Linux process TEEs, addressing the raised challenges. We also survey and analyze the current CVM-based attestation and deployment frameworks combined with GPU benchmarking in CC mode.

From Smartphones to Cloud: Trustworthy Foundations for Digital Sovereignty (Invited Talk)

Authors: Shweta Shinde (ETH Zürich)

As computing moves increasingly to the cloud and AI-powered services, a fundamental question emerges: who truly controls our data and computation? Today's systems force users to trust phone manufacturers, operating system vendors, and cloud providers, i.e., entities whose interests often conflict with user privacy and security. In this talk, I will present a research agenda to build systems that enable trustworthy sovereignty, where users can verify who controls their computation rather than blindly trusting cloud operators and management software.

I will demonstrate this vision by exposing and addressing trust failures across three critical architectural layers of modern computing. First, I'll show how we can enable users to reclaim control of their smartphones—running security-critical applications like encrypted messaging and password managers in isolation from both the operating system and manufacturer backdoors. Second, building such a system revealed a deeper problem: a new class of vulnerabilities that break the security guarantees of all major CPU-based trusted execution environments by exploiting fundamental assumptions about how processors handle hardware interrupts.

Finally, I'll expose an emerging attack surface in chiplet-based processors and accelerators used in the cloud: as components disaggregate, the interconnects linking them can be exploited to completely bypass security. To address this, I'll present techniques to systematically detect and prevent such vulnerabilities in hardware designs before chips reach production. Together, these contributions reveal fundamental vulnerabilities across the computing stack and demonstrate practical paths toward building systems where trust is verified rather than assumed, enabling genuine digital sovereignty for individuals, organizations, and nations.

Biography: Shweta Shinde is an Assistant Professor in the Department of Computer Science at ETH Zurich, where she leads the Secure & Trustworthy Systems (SECTRS) group. Her research focuses on building fundamentally secure large-scale systems. She has a track record of uncovering real-world vulnerabilities in confidential computing environments based on insights that emerge from the understanding gained through her work to secure them. Her defensive research has translated into deployed solutions, with real-world impact extending well beyond the academic setting. Prior to joining ETH Zurich in October 2020, Shweta was a postdoctoral scholar at the University of California, Berkeley, and completed her PhD at the National University of Singapore.