GaloisInc / BESSPIN-FETT-Portal

The web-based portal used by FETT Researchers to manage Target instances.

Apache License 2.0

0 stars 0 forks source link

LEARN: SRI/Cambridge PureCap Description ("Release 2") #449

Closed andrew-bivin closed 4 years ago

andrew-bivin commented 4 years ago

To accompany tomorrow's inclusion of "Release 2", we'd like to add some verbiage in the LEARN section of FETT Portal.

@jrtc27 @brooksdavis @rwatson let us know what you would like included.

For reference, this is the content currently in place for "Release 1" (less language about rebooting, which will be forthcoming shortly!)

SRI/Cambridge
- CPU: Bluespec P2 w/CHERI extension
- OS: CheriBSD (CHERI-extended FreeBSD)
- Applications:
  - Web Server (nginx v.1.13.12)
  - Database (sqlite v.3.22.0)
  - SSH Daemon (OpenSSH 7.3)
  - FETT-Voting voter registration application
  - Additional applications modified to incorporate CHERI protections
  - Researcher-provided and compiled vulnerable applications
- Security researchers are given access to a root shell to interact with custom applications via "su -"
FAQ:
- Content forthcoming if required based on contest activity.

rwatson commented 4 years ago

We probably need to slightly adjust the Release 1 description to mention that it has a “pure-capability userspace” and “hybrid capability kernel”. We can then issue an essentially identical description for release 2 exception that it has a “pure-capability kernel, with reintroduced vulnerabilities” and point at the previously provided vulnerability details (will tag that ticket in a moment .. not on a suitable device to multitask well!).

rwatson commented 4 years ago

447

Comments from @brooksdavis probably the next step.

brooksdavis commented 4 years ago

Some additions:

SRI/Cambridge
- CPU: Bluespec P2 w/CHERI extension
- OS: CheriBSD (CHERI-extended FreeBSD)
  - Enhanced with a pure-capability kernel providing protection from many spatial memory-safety issues
- Applications:
  - ...
  - NFS v4 server exporting /
- Reintroduced kernel vulnerabilities (known to be exploitable on a conventional RISC-V kernel):
  - FreeBSD-SA-18:13.nfs
  - FreeBSD-SA-09:06.ktimer

andrew-bivin commented 4 years ago

@brooksdavis Do those additions apply to both release 1 and 2, or just release 2?

brooksdavis commented 4 years ago

The above (just updated) applies only to Release 2.

andrew-bivin commented 4 years ago

@alex-fivetalent @kurthopfer here is LEARN content with Brooks' updates.

Please add this below the current SRI/Cambridge LEARN entry.

SRI/Cambridge Release 2 (updates in bold)

CPU: Bluespec P2 w/CHERI extension
- OS: CheriBSD (CHERI-extended FreeBSD)
- Enhanced with a pure-capability kernel providing protection from many spatial memory-safety issues
- Applications:
- Web Server (nginx v.1.13.12)
- Database (sqlite v.3.22.0)
- SSH Daemon (OpenSSH 7.3)
- FETT-Voting voter registration application
- Additional applications modified to incorporate CHERI protections
- Researcher-provided and compiled vulnerable applications
- NFS v4 server exporting /
- Reintroduced kernel vulnerabilities (known to be exploitable on a conventional RISC-V kernel):
  - FreeBSD-SA-18:13.nfs
  - FreeBSD-SA-09:06.ktimer
- Security researchers are given access to a root shell to interact with custom applications via "su -"
FAQ:
- Content forthcoming if required based on contest activity.

jrtc27 commented 4 years ago

NFS v4 server exporting

NFS v4 server exporting /

andrew-bivin commented 4 years ago

Noted!

andrew-bivin commented 4 years ago

closing as this is now implemented in prod