Lost and Found in Speculation: Hybrid Speculative Vulnerability Detection

TL;DR

This work introduces Specure, a novel pre-silicon verification method composing hardware fuzzing with Information Flow Tracking (IFT) to address speculative execution leakages and identifies previously overlooked speculative execution vulnerabilities on the RISC-V BOOM processor.

Abstract

Microarchitectural attacks represent a challenging and persistent threat to modern processors, exploiting inherent design vulnerabilities in processors to leak sensitive information or compromise systems. Of particular concern is the susceptibility of Speculative Execution, a fundamental part of performance enhancement, to such attacks. We introduce Specure, a novel pre-silicon verification method composing hardware fuzzing with Information Flow Tracking (IFT) to address speculative execution leakages. Integrating IFT enables two significant and non-trivial enhancements over the existing fuzzing approaches: i) automatic detection of microarchitectural information leakages vulnerabilities without golden model and ii) a novel Leakage Path coverage metric for efficient vulnerability detection. Specure identifies previously overlooked speculative execution vulnerabilities on the RISC-V BOOM processor and explores the vulnerability search space 6.45x faster than existing fuzzing techniques. Moreover, Specure detected known vulnerabilities 20x faster.

Figures (2)

• Figure 1: Overview of Specure. The Offline Phase leverages IFT technique to generate the IFG and PDLC of an RTL model. The Online Phase leverages them to identify the existence and pinpoint the locations of speculative vulnerabilities.
• Figure 2: Coverage analysis of traditional code coverage, and Specure's novel coverage metric.