一句话：提出基于推测契约的随机测试工具 Revizor，自动检测黑盒 CPU 中未知的微架构泄漏。
Spectre、Meltdown 等推测执行攻击利用微架构优化跨安全域泄漏信息，但因缺乏系统分析 CPU 的工具，这类漏洞可能多年未被发现。本文提出 Revizor，一种自动检测黑盒 CPU 微架构泄漏的工具。其核心思想是用推测契约（speculation contracts）建模预期信息泄漏，再通过随机测试将 CPU 的实际泄漏行为与模型对比，从而发现意外泄漏。作者在 Intel CPU 上评估了该工具，证明其能够检测已知漏洞以及此前未知的推测执行泄漏。
Speculative execution attacks such as Spectre and Meltdown exploit microarchitectural optimizations to leak information across security domains. These vulnerabilities often stay undetected for years because we lack the tools for systematic analysis of CPUs to find them. In this article, we introduce such a tool, called Revizor, which automatically detects microarchitectural leakage in black-box CPUs. The key idea is to employ speculation contracts to model the expected information leaks, and then to use randomized testing to compare the CPU’s leakage against the model and thus detect unexpected leaks. We showcase the effectiveness of this approach on Intel CPUs, where we demonstrate that Revizor is capable of detecting both known and previously unknown speculative leaks.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{OleksenkoFKS23,
title = {Revizor: testing black-box CPUs against speculation contracts},
author = {Oleksii Oleksenko and Christof Fetzer and Boris Köpf and Mark Silberstein},
booktitle = {ASPLOS},
year = {2022},
doi = {10.1145/3503222.3507729}
}