Spectre-type attacks are a real threat to secure systems because a successful attack can undermine even an application that would be traditionally considered safe. SpecFuzz is the first tool that enables fuzzing for such vulnerabilities.
The key is a novel concept of speculation exposure: The program is instrumented to simulate speculative execution in software by forcefully executing the code paths that could be triggered due to mispredictions, thereby making the speculative memory accesses visible to integrity checkers (e.g., AddressSanitizer). Combined with the conventional fuzzing techniques, speculation exposure enables more precise identification of potential vulnerabilities compared to state-of-the-art static analyzers.
Technical report: https://arxiv.org/abs/1905.10311
Speakers: Oleksii Oleksenko