The bibliographic entry was discovered and compiled by a machine, and published without a person checking it against the publication. The publication itself is the authors' own work — this badge says nothing about it.
Hunting the Haunter — Efficient Relational Symbolic Execution for Spectre with Haunted RelSE
From OpenAlex, which stores abstracts as an
index of words and their positions: what is shown is rebuilt from that,
and reads fluently whether or not it is what the author wrote.
Abstract
Spectre are microarchitectural attacks which were made public in January 2018.They allow an attacker to recover secrets by exploiting speculations.Detection of Spectre is particularly important for cryptographic libraries and defenses at the software level have been proposed.Yet, defenses correctness and Spectre detection pose challenges due on one hand to the explosion of the exploration space induced by speculative paths, and on the other hand to the introduction of new Spectre vulnerabilities at different compilation stages.We propose an optimization, coined Haunted RelSE, that allows scalable detection of Spectre vulnerabilities at binary level.We prove the optimization semantically correct w.r.t. the more naive explicit speculative exploration approach used in state-of-the-art tools.We implement Haunted RelSE in a symbolic analysis tool, and extensively test it on a wellknown litmus testset for Spectre-PHT, and on a new litmus testset for Spectre-STL, which we propose.Our technique finds more violations and scales better than state-of-the-art techniques and tools, analyzing real-world cryptographic libraries and finding new violations.Thanks to our tool, we discover that indexmasking-a standard defense for Spectre-PHT-and well-known gcc options to compile position independent executables introduce Spectre-STL violations.We propose and verify a correction to index-masking to avoid the problem. A well-known analysis technique that scales well on binary code is symbolic execution (SE) [17], [18]. However, in order
@misc{daniel2021hunting,
title = {Hunting the Haunter — Efficient Relational Symbolic Execution for Spectre with Haunted RelSE},
author = {Lesly-Ann Daniel and Sébastien Bardin and Tamara Rezk},
year = {2021},
journal = {Network and Distributed System Security Symposium},
doi = {10.14722/ndss.2021.24286},
}