DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs

Security bugs in CPUs have critical security impacts to all the computation related hardware and software components as it is the core of the computation. In spite of the fact that architecture and security communities have explored a vast number of static or dynamic analysis techniques to automatic...

Full description

Saved in:
Bibliographic Details
Published in2021 IEEE Symposium on Security and Privacy (SP) pp. 1286 - 1303
Main Authors Hur, Jaewon, Song, Suhwan, Kwon, Dongup, Baek, Eunjin, Kim, Jangwoo, Lee, Byoungyoung
Format Conference Proceeding
LanguageEnglish
Published IEEE 01.05.2021
Subjects
Computer architecture
Computer bugs
CPU-bugs
Differential-Fuzzing
Fuzzing
Hardware
Privacy
Protocols
Register-coverage
Rockets
Online AccessGet full text

Cover

More Information
Summary:Security bugs in CPUs have critical security impacts to all the computation related hardware and software components as it is the core of the computation. In spite of the fact that architecture and security communities have explored a vast number of static or dynamic analysis techniques to automatically identify such bugs, the problem remains unsolved and challenging largely due to the complex nature of CPU RTL designs.This paper proposes DIFUZZRTL, an RTL fuzzer to automatically discover unknown bugs in CPU RTLs. DIFUZZRTL develops a register-coverage guided fuzzing technique, which efficiently yet correctly identifies a state transition in the finite state machine of RTL designs. DIFUZZRTL also develops several new techniques in consideration of unique RTL design characteristics, including cycle-sensitive register coverage guiding, asynchronous interrupt events handling, a unified CPU input format with Tilelink protocols, and drop-in-replacement designs to support various CPU RTLs. We implemented DIFUZZRTL, and performed the evaluation with three real-world open source CPU RTLs: OpenRISC Mor1kx Cappuccino, RISC-V Rocket Core, and RISC-V Boom Core. During the evaluation, DIFUZZRTL identified 16 new bugs from these CPU RTLs, all of which were confirmed by the respective development communities and vendors. Six of those are assigned with CVE numbers, and to the best of our knowledge, we reported the first and the only CVE of RISC-V cores, demonstrating its strong practical impacts to the security community.
ISSN:2375-1207
DOI:10.1109/SP40001.2021.00103