Protecting the Linux Kernel from Confidential Computing Threats...

Overview: Elena and Carlos present at Linux Security Summit North America on protecting the Linux kernel in confidential computing environments, sharing their experience submitting backports.

Key Topics: Confidential computing threat models for cloud workloads; protection in transit and at rest versus gaps during processing; kernel community pushback on confidential computing patches; and aligning security fixes with upstream philosophy.

Technical Details: Presenters describe submitting PCI subsystem buffer overflow fixes for confidential computing threat models, receiving pushback that Linux wasn't designed for these threat models. They discuss navigating kernel community expectations while addressing TEE-specific vulnerabilities.

Takeaways: Confidential computing introduces threat models the Linux kernel wasn't originally designed for. Security researchers must engage constructively with kernel maintainers to build appropriate protections.