[Paper Review] Adversarial Symbolic Execution for Detecting Concurrency-Related Cache Timing Leaks

Shengjian Guo, Meng Wu+1 more|arXiv (Cornell University)|Jul 9, 2018

Parallel Computing and Optimization Techniques3 citations

TL;DR

This paper proposes adversarial symbolic execution (SymSC), a method that detects concurrency-induced cache timing side-channel leaks in cryptographic programs by symbolically exploring thread interleavings and modeling cache behavior using SMT solving. It identifies realistic leaks in real-world ciphers that are undetected by prior tools, demonstrating that timing leak-freedom is not compositional under concurrency.

ABSTRACT

The timing characteristics of cache, a high-speed storage between the fast CPU and the slowmemory, may reveal sensitive information of a program, thus allowing an adversary to conduct side-channel attacks. Existing methods for detecting timing leaks either ignore cache all together or focus only on passive leaks generated by the program itself, without considering leaks that are made possible by concurrently running some other threads. In this work, we show that timing-leak-freedom is not a compositional property: a program that is not leaky when running alone may become leaky when interleaved with other threads. Thus, we develop a new method, named adversarial symbolic execution, to detect such leaks. It systematically explores both the feasible program paths and their interleavings while modeling the cache, and leverages an SMT solver to decide if there are timing leaks. We have implemented our method in LLVM and evaluated it on a set of real-world ciphers with 14,455 lines of C code in total. Our experiments demonstrate both the efficiency of our method and its effectiveness in detecting side-channel leaks.

Motivation & Objective

• To address the gap in existing tools that ignore cache timing leaks in concurrent programs.
• To show that timing-leak-freedom is not compositional: a program may be secure in isolation but leak when interleaved with adversarial threads.
• To develop a systematic method for detecting cache timing leaks arising from interference between concurrent threads.
• To model cache behavior accurately during symbolic execution while minimizing computational overhead.
• To evaluate the method on real-world cryptographic implementations and demonstrate its effectiveness in uncovering previously undetected leaks.

Proposed method

• Symbolically executes both the victim thread (e.g., a cryptographic function) and a potentially adversarial thread, exploring all feasible paths and interleavings.
• Constructs dynamic cache behavior constraints during symbolic execution to model when memory accesses result in cache hits or misses.
• Leverages an SMT solver to check for input-dependent divergence in cache behavior: two distinct inputs causing different hit/miss patterns under the same interleaving.
• Uses on-the-fly pruning of redundant interleavings based on cache behavior constraints to mitigate path and interleaving explosion.
• Models cache behavior based on cache configuration (e.g., associativity, line size) and tracks cache line access patterns across threads.
• Automatically generates adversarial threads and interleaving schedules when not provided, enabling full automation of leak detection.

Experimental results

Research questions

• RQ1 Can a program that is timing-leak-free in isolation become vulnerable to cache timing side-channel attacks when executed concurrently with another thread?
• RQ2 What systematic exploration strategy can detect adversarial interleavings that expose cache-based timing leaks?
• RQ3 How can cache behavior be accurately modeled during symbolic execution to detect data-dependent hit/miss patterns?
• RQ4 To what extent do real-world cryptographic implementations contain concurrency-induced cache timing leaks?
• RQ5 Can symbolic execution with SMT solving detect concrete inputs and interleavings that trigger such leaks?

Key findings

• The study demonstrates that timing-leak-freedom is not a compositional property: concurrent execution can expose cache timing leaks even in programs with identical instruction counts.
• SymSC successfully detected concrete cache timing leaks in 20 real-world cipher programs totaling 14,455 lines of C code.
• The method identified realistic attack scenarios involving adversarial thread interference that were undetected by prior tools focusing only on sequential execution.
• Cache behavior constraints enabled effective pruning of redundant interleavings, improving scalability despite the state-space explosion problem.
• The tool generated concrete inputs and interleaving schedules that cause divergent cache behavior, proving the practicality of the detected leaks.
• No existing tool was capable of detecting such concurrency-induced cache timing leaks, establishing SymSC as the first method to address this problem.