BaselineWatch
26 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST platform security: roots of trust, firmware and secure enclaves IR 8320

26 requirements · published 2022-05-04
Changes in this version
All1 Introduction2 Hardware Platform Security Overview3 Platform Integrity Verification4 Software Runtime Protection Mechanisms5 Data Protection and Confidential Computing6 Remote Attestation Services7 Cloud Use Case Scenarios Leveraging Hardware-Enabled Security8 Next Steps
RefTitleText
4 Software Runtime Protection Mechanisms This section describes various software runtime attacks and protection mechanisms.
4.1
in 4
 Return Oriented Programming (ROP) and Call/Jump Oriented Programming (COP/JOP) Attacks ROP attacks focus on utilizing buffer overflows and targeted memory overwrites of return addresses in the stack. Attackers redirect return flows by corrupting addresses on the data stack to be locations in already-executa
4.2
in 4
 Address Translation Attacks Commodity OSs rely on virtual memory protection models enabled via paging enforced by the processor memory management unit (MMU). OSs isolate process and kernel memory using page tables managed by systems software, with access permissions s
4.3
in 4
 Memory Safety Violations Approximately 70 percent of the vulnerabilities addressed through security updates each year are memory safety issues [12] . They are especially common in programs written in languages such as C and C++ that expose pointers. These code bugs
4.4
in 4
 Side-Channel Attacks The vulnerability underlying cache timing side-channel attacks is that the pattern of allocations into the cache of a central processing unit (CPU), and, in particular, which cache sets have been used for the allocation, can be determined b

5 of 26.