RISC-V Security Training

DATE: 7-10 November 2022

TIME: 09:00 – 12:00 & 14:00 – 17:00  GST/GMT+4

This training is designed to give students the knowledge and skills required to analyze, identify, target, and exploit flaws in both RISC-V processors, and applications and kernels written for the architecture. Not only will RISC-V application level exploitation be a focus of the training session, processor exploitation will also be a focus, providing students with insights into architectural design choices that make RISC-V more resilient to side channel attacks, “trustzone” escapes, and privilege “ring” escalation attacks.

Students will complete the class with a full understanding of the RISC-V architecture and its variants, how to identify/analyze a RISC-V processor, and how to target and exploit an application or kernel running on a RISC-V CPU. Students will learn how the architecture’s formal definition differs from implementations of the processor specification, and will learn how to target subtleties in the specification that grant implementors the flexibility to introduce potential architecture flaws that can be exploited in order to cross privilege boundaries or leak/exfil privileged data.

Variations of RISC-V technology will be discussed, such as the “unhackable” Morpheus microarchitecture, production variants such as SiFive’s product line, and security focused chips such as HexFive and LowRISC.

Topics covered:

• RISC-V Architecture
• RISC-V Privilege models and extensions
• RISC-V peripherals and bus model
• RISC-V debugging and testing
• Application development environment
• Toolchains, soft debugging
• Kernel and application privilege layers
• Exploiting kernels
• Exploiting applications
• Tagged memory
• Side channel attacks
• Software protections in RISC-V