2020 IEEE/ACM 42nd International Conference on Software Engineering (ICSE) SpecuSym: Speculative Symbolic Execution for Cache Timing Leak Detection Shengjian Guo∗ Yueqi Chen∗ Peng Li, Yueqiang Cheng Baidu Security Penn State University Baidu Security
[email protected] [email protected] {lipeng28,chengyueqiang}@baidu.com Huibo Wang Meng Wu Zhiqiang Zuo Baidu Security Ant Financial Services Group State Key Lab. for Novel Software
[email protected] [email protected] Technology, Nanjing University
[email protected] ABSTRACT ACM Reference Format: CPU cache is a limited but crucial storage component in modern Shengjian Guo, Yueqi Chen, Peng Li, Yueqiang Cheng, Huibo Wang, Meng processors, whereas the cache timing side-channel may inadver- Wu, and Zhiqiang Zuo. 2020. SpecuSym: Speculative Symbolic Execution for Cache Timing Leak Detection. In 42nd International Conference on Software tently leak information through the physically measurable timing Engineering (ICSE ’20), May 23–29, 2020, Seoul, Republic of Korea. ACM, New variance. Speculative execution, an essential processor optimiza- York, NY, USA, 13 pages. https://doi.org/10.1145/3377811.3380428 tion, and a source of such variances, can cause severe detriment on deliberate branch mispredictions. Despite static analysis could 1 INTRODUCTION qualitatively verify the timing-leakage-free property under specula- tive execution, it is incapable of producing endorsements including CPU cache is a limited but crucial storage area on modern processor inputs and speculated flows to diagnose leaks in depth. This work chips. It primarily relieves the speed disparity between the rapid proposes a new symbolic execution based method, SpecuSym, for processors and the slow main memory, by buffering recently used precisely detecting cache timing leaks introduced by speculative data for faster reuse.