Tag: Speculative Execution

Black Hat USA 2025 | Racing for Privilege

  • Haco
  • April 7, 2026
  • 2 min read

The main point is that Intel’s modern Spectre v2 defenses, especially eIBRS, can fail because branch predictor updates happen asynchronously. The researchers show that this timing creates “Branch Predictor Race Conditions” (BPRC), where branch predictions can be learned or applied with the wrong privilege context. In practice, that breaks intended isolation boundaries such as user-to-kernel, guest-to-hypervisor, and even barriers meant to flush unsafe predictions. The talk’s key attack is called Branch Privilege Injection (BPI). In plain English: an unprivileged process can trick the CPU into treating attacker-controlled branch…

SysBumps: Exploiting Speculative Execution in System Calls

  • Haco
  • September 2, 2025
  • 3 min read

The video presents an attack technique called SysBumps, demonstrated by researchers Hyerean Jang, Taehun Kim, and Youngjoo Shin at Black Hat Europe 2024. Here’s what it’s about: What SysBumps DoesSysBumps breaks Kernel Address Space Layout Randomization (KASLR) on macOS systems running on Apple Silicon, including M-series chips. It uses speculative execution within system calls, triggering side-channel behaviors that allow an unprivileged attacker to detect kernel memory layout. How the Attack WorksBy system calls that involve speculative execution, attackers can influence the translation lookaside buffer (TLB). This manipulation allows…

Bypassing ARM’s Memory Tagging Extension with a Side-Channel Attack

  • Haco
  • September 2, 2025
  • 2 min read

This explains a research project on how to bypass ARM's Memory Tagging Extension (MTE), a hardware feature designed to prevent memory corruption vulnerabilities. Here are the key takeaways: ARM MTE: MTE works like a "lock and key" system. Pointers have a "key" (a 4-bit tag) and memory objects have a "lock" (also a 4-bit tag). If the key and lock don't match when a pointer tries to access memory, the program will crash, preventing an attack. The Challenge: The tags are randomly generated, making it difficult for an…