2021

Fuzzing Hardware Like Software

Trippel, Timothy, Shin, Kang G., Chernyakhovsky, Alex et al.

Understand

Hardware flaws are permanent and potent: hardware cannot be patched once fabricated, and any flaws may undermine any software executing on top.

Consequently, verification time dominates implementation time.
The gold standard in hardware Design Verification (DV) is concentrated at two extremes: random dynamic verification and formal verification.
Both struggle to root out the subtle flaws in complex hardware that often manifest as security vulnerabilities.

Built on

G. E. Moore, “Cramming more components onto integrated circuits,” 1965
1965
Earlier work this paper cites.
R. H. Dennard, F. H. Gaensslen, V. L. Rideout, E. Bassous, and A. R. LeBlanc, “Design of ion-implanted mosfet’s with very small physical dimensions,” IEEE Journal of Solid-State Circuits , 1974
1974
Earlier work this paper cites.
H. Krawczyk, M. Bellare, and M. Bellare, “HMAC: Keyed-hashing for message authentication,” RFC Editor, RFC 2104, February 1997. [Online]. Available: \url{https://www.rfc-editor.org/rfc/rfc2104.txt}
1997
Earlier work this paper cites.
J.-Y. Jou and C.-N. J. Liu, “Coverage analysis techniques for hdl design validation,” Proceedings of Asia Pacific CHip Design Languages , 1999
1999
Earlier work this paper cites.
M. Bose, J. Shin, E. M. Rudnick, T. Dukes, and M. Abadir, “A genetic approach to automatic bias generation for biased random instruction generation,” in Proceedings of the Congress on Evolutionary Computation . IEEE, 2001
2001
Earlier work this paper cites.
S. Tasiran and K. Keutzer, “Coverage metrics for functional validation of hardware designs,” IEEE Design & Test of Computers , 2001
2001
Earlier work this paper cites.
S. Fine and A. Ziv, “Coverage directed test generation for functional verification using bayesian networks,” in the 40th annual Design Automation Conference (DAC) , 2003
2003
Earlier work this paper cites.
J. Yuan, C. Pixley, A. Aziz, and K. Albin, “A framework for constrained functional verification,” in International Conference on Computer Aided Design (ICCAD) . IEEE, 2003
2003
Earlier work this paper cites.
C. Lattner and V. Adve, “LLVM: A compilation framework for lifelong program analysis and transformation,” in International Symposium on Code Generation and Optimization (CGO) , San Jose, CA, USA, 2004
2004
Earlier work this paper cites.
G. Squillero, “Microgp—an evolutionary assembly program generator,” Genetic Programming and Evolvable Machines , 2005
2005
Earlier work this paper cites.
O. Guzey and L.-C. Wang, “Coverage-directed test generation through automatic constraint extraction,” in IEEE International High Level Design Validation and Test Workshop (HLDVT) , 2007
2007
Earlier work this paper cites.
A. Piziali, Functional verification coverage measurement and analysis . Springer Science & Business Media, 2007
2007
Earlier work this paper cites.
M. Sutton, A. Greene, and P. Amini, Fuzzing: brute force vulnerability discovery . Pearson Education, 2007
2007
Earlier work this paper cites.
V. Paxson, W. Estes, and J. Millaway, “Lexical analysis with flex,” University of California , 2007
2007
Earlier work this paper cites.
C. Cadar, D. Dunbar, D. R. Engler et al. , “KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs.” in USENIX Symposium on Operating Systems Design and Implementation (OSDI) , 2008
2008
Earlier work this paper cites.
L.-T. Wang, Y.-W. Chang, and K.-T. T. Cheng, Electronic design automation: synthesis, verification, and test . Morgan Kaufmann, 2009
2009
Earlier work this paper cites.
R. Kaivola, R. Ghughal, N. Narasimhan, A. Telfer, J. Whittemore, S. Pandav, A. Slobodová, C. Taylor, V. Frolov, E. Reeber et al. , “Replacing testing with formal verification in intel core i7 processor execution engine validation,” in International Conference on Computer Aided Verification (CAV) . Springer, 2009
2009
Earlier work this paper cites.
R. Hameed, W. Qadeer, M. Wachs, O. Azizi, A. Solomatnikov, B. C. Lee, S. Richardson, C. Kozyrakis, and M. Horowitz, “Understanding sources of inefficiency in general-purpose chips,” in the 37th annual International Symposium on Computer Architecture (ISCA) , 2010
2010
Earlier work this paper cites.
T. Wang, T. Wei, G. Gu, and W. Zou, “TaintScope: A checksum-aware directed fuzzing tool for automatic software vulnerability detection,” in IEEE Symposium on Security and Privacy (S&P) , 2010
2010
Earlier work this paper cites.
C. Ioannides, G. Barrett, and K. Eder, “Introducing xcs to coverage directed test generation,” in IEEE International High Level Design Validation and Test Workshop (HLDVT) , 2011
2011
Earlier work this paper cites.
V. Chipounov, V. Kuznetsov, and G. Candea, “S2E: A platform for in-vivo multi-path analysis of software systems,” ACM SIGPLAN International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) , 2011
2011
Earlier work this paper cites.
S. K. Cha, T. Avgerinos, A. Rebert, and D. Brumley, “Unleashing mayhem on binary code,” in IEEE Symposium on Security and Privacy (S&P) , 2012
2012
Earlier work this paper cites.

Similar

P. Godefroid, M. Y. Levin, and D. Molnar, “SAGE: whitebox fuzzing for security testing,” Queue , 2012
2012
Cited alongside, same era.
E. Bounimova, P. Godefroid, and D. Molnar, “Billions and billions of constraints: Whitebox fuzz testing in production,” in 2013 35th International Conference on Software Engineering (ICSE) . IEEE, 2013
2013
Cited alongside, same era.
T. Chen, Z. Du, N. Sun, J. Wang, C. Wu, Y. Chen, and O. Temam, “Diannao: A small-footprint high-throughput accelerator for ubiquitous machine-learning,” ACM SIGARCH Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS) , 2014
2014
Cited alongside, same era.
M. Teplitsky, A. Metodi, and R. Azaria, “Coverage driven distribution of constrained random stimuli,” in Proceedings of the Design and Verification Conference (DVCon) , 2015
2015
Cited alongside, same era.
M. Zalewski, “afl-fuzz: making up grammar with a dictionary in hand,” https://lcamtuf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html
2015
Cited alongside, same era.
T. Nowatzki, V. Gangadhan, K. Sankaralingam, and G. Wright, “Pushing the limits of accelerator efficiency while retaining programmability,” in IEEE International Symposium on High Performance Computer Architecture (HPCA) , 2016
2016
Cited alongside, same era.
I. Magaki, M. Khazraee, L. V. Gutierrez, and M. B. Taylor, “ASIC clouds: Specializing the datacenter,” in 2016 ACM/IEEE 43rd Annual International Symposium on Computer Architecture (ISCA) . IEEE, 2016, pp. 178–190
2016
Cited alongside, same era.
K. Gent and M. S. Hsiao, “Fast multi-level test generation at the rtl,” in 2016 IEEE Computer Society Annual Symposium on VLSI (ISVLSI) , 2016
2016
Cited alongside, same era.
K. Yang, M. Hicks, Q. Dong, T. Austin, and D. Sylvester, “A2: Analog malicious hardware,” in IEEE Symposium on Security and Privacy (SP) , 2016
2016
Cited alongside, same era.
K. Serebryany, “Continuous fuzzing with libfuzzer and addresssanitizer,” in Cybersecurity Development (SecDev) . IEEE, 2016
2016
Cited alongside, same era.
N. Stephens, J. Grosen, C. Salls, A. Dutcher, R. Wang, J. Corbetta, Y. Shoshitaishvili, C. Kruegel, and G. Vigna, “Driller: Augmenting fuzzing through selective symbolic execution.” in Network and Distributed Systems Security Symposium (NDSS) , 2016
2016
Cited alongside, same era.
J. Kelsey, S.-j. Chang, and R. Perlner, “SHA-3 derived functions: cSHAKE, KMAC, TupleHash, and ParallelHash,” National Institute of Standards and Technology, Tech. Rep., 2016
2016
Cited alongside, same era.

Then

F. Wang, H. Zhu, P. Popli, Y. Xiao, P. Bodgan, and S. Nazarian, “Accelerating coverage directed test generation for functional verification: A neural network-based framework,” in Proceedings of the Great Lakes Symposium on VLSI , 2018
2018
Later among the works it cites.
R. Zhang and C. Sturton, “A recursive strategy for symbolic execution to find exploits in hardware designs,” in ACM SIGPLAN International Workshop on Formal Methods and Security (FSM) , 2018
2018
Later among the works it cites.
R. Zhang, C. Deutschbein, P. Huang, and C. Sturton, “End-to-end automated exploit generation for validating the security of processor designs,” in 51st Annual IEEE/ACM International Symposium on Microarchitecture (MICRO) . IEEE, 2018
2018
Later among the works it cites.
H. Chen, Y. Xue, Y. Li, B. Chen, X. Xie, X. Wu, and Y. Liu, “Hawkeye: Towards a desired directed grey-box fuzzer,” in ACM SIGSAC Conference on Computer and Communications Security (CCS) , 2018
2018
Later among the works it cites.
I. Yun, S. Lee, M. Xu, Y. Jang, and T. Kim, “ { \{ QSYM } \} : A practical concolic execution engine tailored for hybrid fuzzing,” in { \{ USENIX } \} Security Symposium , 2018
2018
Later among the works it cites.
H. Peng, Y. Shoshitaishvili, and M. Payer, “T-fuzz: fuzzing by program transformation,” in IEEE Symposium on Security and Privacy (S&P) , 2018
2018
Later among the works it cites.
M. Corporation, “Cve details: Intel: Vulnerability statistics,” August 2019, https://www.cvedetails.com/vendor/238/Intel.html
2019
Later among the works it cites.
P. Kocher, J. Horn, A. Fogh, , D. Genkin, D. Gruss, W. Haas, M. Hamburg, M. Lipp, S. Mangard, T. Prescher, M. Schwarz, and Y. Yarom, “Spectre attacks: Exploiting speculative execution,” in 40th IEEE Symposium on Security and Privacy (S&P’19) , 2019
2019
Later among the works it cites.
S. van Schaik, A. Milburn, S. Österlund, P. Frigo, G. Maisuradze, K. Razavi, H. Bos, and C. Giuffrida, “RIDL: Rogue in-flight data load,” in 40th IEEE Symposium on Security and Privacy (S&P’19) , 2019
2019
Later among the works it cites.
C. Canella, D. Genkin, L. Giner, D. Gruss, M. Lipp, M. Minkin, D. Moghimi, F. Piessens, M. Schwarz, B. Sunar, J. Van Bulck, and Y. Yarom, “Fallout: Leaking data on meltdown-resistant CPUs,” in ACM SIGSAC Conference on Computer and Communications Security (CCS) , 2019
2019
Later among the works it cites.
M. Cieplucha, “Metric-driven verification methodology with regression management,” Journal of Electronic Testing , 2019
2019
Later among the works it cites.
S. Nagy and M. Hicks, “Full-speed fuzzing: Reducing fuzzing overhead through coverage-guided tracing,” in Symposium on Security and Privacy (S&P) . IEEE, 2019
2019
Later among the works it cites.
C. Aschermann, T. Frassetto, T. Holz, P. Jauernig, A.-R. Sadeghi, and D. Teuchert, “NAUTILUS: Fishing for deep bugs with grammars.” in Network and Distributed Systems Security Symposium (NDSS) , 2019
2019
Later among the works it cites.
——, “Superion: Grammar-aware greybox fuzzing,” in IEEE/ACM International Conference on Software Engineering (ICSE) , 2019
2019
Later among the works it cites.
D. Moghimi, B. Sunar, T. Eisenbarth, and N. Heninger, “TPM-FAIL: TPM meets Timing and Lattice Attacks,” in 29th USENIX Security Symposium (USENIX Security’20) , 2020. [Online]. Available: https://www.usenix.org/conference/usenixsecurity20/presentation/moghimi
2020
Later among the works it cites.
P. Zong, T. Lv, D. Wang, Z. Deng, R. Liang, and K. Chen, “FuzzGuard: Filtering out unreachable inputs in directed grey-box fuzzing through deep learning,” in USENIX Security Symposium , 2020
2020
Later among the works it cites.
C. Aschermann, S. Schumilo, A. Abbasi, and T. Holz, “Ijon: Exploring deep state spaces via fuzzing,” in IEEE Symposium on Security and Privacy (S&P) , 2020
2020
Later among the works it cites.
S. Österlund, K. Razavi, H. Bos, and C. Giuffrida, “ParmeSan: Sanitizer-guided greybox fuzzing,” in USENIX Security Symposium , 2020
2020
Later among the works it cites.
H. Huang, P. Yao, R. Wu, Q. Shi, and C. Zhang, “PANGOLIN: Incremental hybrid fuzzing with polyhedral path abstraction,” in IEEE Symposium on Security and Privacy (S&P) , 2020
2020
Later among the works it cites.
l. Contributors, “OpenTitan: Comportability Definition and Specification,” November 2020, https://docs.opentitan.org/doc/rm/comportability_specification/
2020
Later among the works it cites.
S. Inc., “SiFive: TileLink Specification,” November 2020, version 1.8.0
2020
Later among the works it cites.
J. Taylor, “Kaze: an HDL embedded in Rust,” November 2020, https://docs.rs/kaze/0.1.13/kaze/
2020
Later among the works it cites.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…