一句话：提出 DejaVuzz，通过动态可交换内存与差分信息流追踪提升处理器瞬态执行漏洞模糊测试的效果与效率。
瞬态执行漏洞严重威胁现代处理器，硬件模糊测试虽在乱序处理器设计中展现出发现此类漏洞的潜力，却因微架构可控性与可观测性不足而效率低下。本文提出面向流片前阶段的处理器瞬态执行漏洞模糊测试器 DejaVuzz，其核心是两个创新操作原语：动态可交换内存与差分信息流追踪。动态可交换内存可在同一地址空间内隔离不同指令流，从而为任意瞬态窗口生成定向训练并消除无效训练，高效触发多样瞬态窗口；差分信息流追踪则观测敏感数据在微架构中的传播，基于污点设计污点覆盖矩阵引导变异，并利用污点活跃性注解识别可利用泄漏。评估表明，DejaVuzz 优于当前最优模糊测试器 SpecDoctor，以更低训练开销触发更全面的瞬态窗口，覆盖率提升 4.7 倍，并以可接受开销缓解控制流过度污点问题，在 BOOM 与香山处理器上发现 5 个此前未知的瞬态执行漏洞（获 6 个 CVE）。
Transient execution vulnerabilities have emerged as a critical threat to modern processors. Hardware fuzzing testing techniques have recently shown promising results in discovering transient execution bugs in large-scale out-of-order processor designs. However, their poor microarchitectural controllability and observability prevent them from effectively and efficiently detecting transient execution vulnerabilities. This paper proposes DejaVuzz, a novel pre-silicon stage processor transient execution bug fuzzer. DejaVuzz utilizes two innovative operating primitives: dynamic swappable memory and differential information flow tracking, enabling more effective and efficient transient execution vulnerability detection. The dynamic swappable memory enables the isolation of different instruction streams within the same address space. Leveraging this capability, DejaVuzz generates targeted training for arbitrary transient windows and eliminates ineffective training, enabling efficient triggering of diverse transient windows. The differential information flow tracking aids in observing the propagation of sensitive data across the microarchitecture. Based on taints, DejaVuzz designs the taint coverage matrix to guide mutation and uses taint liveness annotations to identify exploitable leakages. Our evaluation shows that DejaVuzz outperforms the state-of-the-art fuzzer SpecDoctor, triggering more comprehensive transient windows with lower training overhead and achieving a 4.7x coverage improvement. And DejaVuzz also mitigates control flow over-tainting with acceptable overhead and identifies 5 previously undiscovered transient execution vulnerabilities (with 6 CVEs assigned) on BOOM and XiangShan.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{XuZZLTZZCS25,
title = {DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking Assisted Processor Fuzzing},
author = {Jinyan Xu and Yangye Zhou and Xingzhi Zhang and Yinshuai Li and Qinhan Tan and Yinqian Zhang and Yajin Zhou and Rui Chang and Wenbo Shen},
booktitle = {ASPLOS},
year = {2025},
doi = {10.1145/3676642.3736115}
}