[论文解读] TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities

Aakash Tyagi, Addison Crump+5 more|arXiv (Cornell University)|Jan 24, 2022

Adversarial Robustness in Machine Learning被引用 37

一句话总结

TheHuzz 是一个使用黄金参考模型来生成指令序列的硬件模糊器，揭示软件可利用的硬件漏洞，并在速度上超过先前的模糊器和随机回归方法。

ABSTRACT

The increasing complexity of modern processors poses many challenges to existing hardware verification tools and methodologies for detecting security-critical bugs. Recent attacks on processors have shown the fatal consequences of uncovering and exploiting hardware vulnerabilities. Fuzzing has emerged as a promising technique for detecting software vulnerabilities. Recently, a few hardware fuzzing techniques have been proposed. However, they suffer from several limitations, including non-applicability to commonly used Hardware Description Languages (HDLs) like Verilog and VHDL, the need for significant human intervention, and inability to capture many intrinsic hardware behaviors, such as signal transitions and floating wires. In this paper, we present the design and implementation of a novel hardware fuzzer, TheHuzz, that overcomes the aforementioned limitations and significantly improves the state of the art. We analyze the intrinsic behaviors of hardware designs in HDLs and then measure the coverage metrics that model such behaviors. TheHuzz generates assembly-level instructions to increase the desired coverage values, thereby finding many hardware bugs that are exploitable from software. We evaluate TheHuzz on four popular open-source processors and achieve 1.98x and 3.33x the speed compared to the industry-standard random regression approach and the state-of-the-art hardware fuzzer, DiffuzRTL, respectively. Using TheHuzz, we detected 11 bugs in these processors, including 8 new vulnerabilities, and we demonstrate exploits using the detected bugs. We also show that TheHuzz overcomes the limitations of formal verification tools from the semiconductor industry by comparing its findings to those discovered by the Cadence JasperGold tool.

研究动机与目标

• 推动超越传统形式化验证和运行时检查的可扩展、自动化硬件漏洞检测的需求。
• 开发一个硬件模糊器，(i) 支持 Verilog/VHDL HDL，(ii) 能与标准集成电路设计流集成，(iii) 在没有先前设计知识的情况下检测软件可利用的硬件漏洞。
• 表征硬件本征行为并推导覆盖度量，以捕捉信号跃迁、悬空线、有限状态机等 RTL 特征，从而引导模糊测试。
• 在真实开源处理器上展示 TheHuzz 的效果，并与现有硬件模糊器和形式化验证工具进行比较。

提出的方法

• 提出 TheHuzz 架构，包括种子生成、刺激生成、变异引擎，以及使用黄金参考模型进行对比的错误检测模块。
• 定义硬件特定的覆盖度量，捕捉组合逻辑/时序逻辑、信号跃迁、悬浮线和 FSM 状态等。
• 生成 ISA 级种子输入（配置指令和测试指令），并在二进制层面对指令进行变异，以探索超出规格的输入。
• 使用基于优化的方法选择指令-变异对，以在最大化覆盖率的同时最小化测试对的集合。
• 通过将 RTL 仿真轨迹与黄金参考模型进行匹配来检测漏洞，并对分析标记不匹配项。

实验结果

研究问题

• RQ1 硬件模糊测试器如何有效捕捉内在的 RTL 行为，以发现与安全相关的漏洞？
• RQ2 直接在 RTL 上进行、具备硬件感知覆盖的模糊测试方法，是否能在发现可被软件利用的漏洞方面超过基于软件的模糊测试或现有的硬件模糊器？
• RQ3 在真实处理器设计中，优化指令-变异对对覆盖率与漏洞发现效率的影响如何？

主要发现

• TheHuzz 相对于行业标准的随机回归方法实现了 1.98× 的加速，相对于 DiffuzRTL 实现了 3.33×。
• 在四个处理器（or1200、mor1kx、Ariane 和 Rocket Core）上评估，TheHuzz 发现了 11 个漏洞，其中包括 8 个新漏洞。
• 所发现的漏洞包括可被软件利用的问题，且有未授权软件的利用示例。
• 与 Cadence JasperGold 相比，TheHuzz 克服了状态爆炸、资源密集以及对专家知识的依赖。
• 作者计划将 TheHuzz 开源，以促进硬件模糊测试领域的进一步研究。