An Investigation of Hardware Security Bug Characteristics in Open-Source Projects
Joey Ah-kiow, Benjamin Tan
TL;DR
This paper investigates hardware security bug characteristics in open-source HDL projects by conducting a deep-dive into OpenTitan bug reports and fixes. It manually classifies bugs as security or functional, analyzes their impacts and locations, and examines fix footprints, revealing that about 53% of bugs have security implications and that most fixes touch only a single file. An abstract syntax tree (AST)-based analysis is used to extract syntactic characteristics of bug fixes, uncovering that assignments dominate fix constructs and that bug fixes tend to be highly localized with small footprints. The findings highlight the value of security-aware development practices and motivate static analysis and repair techniques that leverage the localized nature of hardware bugs, especially in cryptography IPs. The study also provides open-source data and methods to guide future HDL security research and tooling development.
Abstract
Hardware security is an important concern of system security as vulnerabilities can arise from design errors introduced throughout the development lifecycle. Recent works have proposed techniques to detect hardware security bugs, such as static analysis, fuzzing, and symbolic execution. However, the fundamental properties of hardware security bugs remain relatively unexplored. To gain a better understanding of hardware security bugs, we perform a deep dive into the popular OpenTitan project, including its bug reports and bug fixes. We manually classify the bugs as relevant to functionality or security and analyze characteristics, such as the impact and location of security bugs, and the size of their bug fixes. We also investigate relationships between security impact and bug management during development. Finally, we propose an abstract syntax tree-based analysis to identify the syntactic characteristics of bug fixes. Our results show that 53% of the bugs in OpenTitan have potential security implications and that 55% of all bug fixes modify only one file. Our findings underscore the importance of security-aware development practices and tools and motivate the development of techniques that leverage the highly localized nature of hardware bugs.