UISFuzz: An Efficient Fuzzing Method for CPU Undocumented Instruction Searching

Abstract

With the rapid development of network security and the frequent appearance of CPU vulnerabilities, CPU security have gradually raised great attention and become a crucial issue in the computer field. Undocumented instructions, as one of the important threats to system security, is an important entry for CPU security research. Using fuzzing technology can automatically test the CPU instruction set and discover potential undocumented instructions, but the existing methods are of slow search speed and low accuracy. Therefore, this paper designs an efficient fuzzing method (UISFuzz) for undocumented instruction searching. This method has the following merits: (1) the instruction search speed is greatly improved by an automatic instruction format recognition, as the low efficient part of the known instruction format is skipped and therefore the instruction search space is much narrowed; (2) the false positive rate is reduced by a recheck mechanism based on the expert knowledge database to filter the wrongly found instructions; (3) the overhead of the method is decreased by optimizing the result analysis program, and the scope of the system is expanded, where more processors with lower performance are compatible. Typical CPU experimental results show that, the UISFuzz can successfully find undocumented instructions in the CPUs and simultaneously improve the time efficiency by 5 times compared with existing tools. INDEX TERMS Undocumented instructions, fuzz, CPU, instruction analysis. I. INTRODUCTION

An efficient mining method for DSP undocumented instruction

“…In 2018, Jianping Zhu et al [9] proposed a comprehensive CPU security benchmark to evaluate the hardware security of processors, which contains numerous known CPU vulnerabilities. In 2019, Xixing Li et al [10] proposed an undocumented instruction search method for CPUs of the x86 architecture named UISfuzz. This method further reduces the search space based on Sandsifter and improves the search efficiency through instruction format identification.…”

IMSC: Instruction set architecture monitor and secure cache for protecting processor systems from undocumented instructions

“…Domas [9] demonstrated a hardware back-door in a commercial x86 processor, and Duflot [1] exposed the security threats of the undocumented instructions. In response to the serious security concern over the fact that an undocumented instruction may actually exist in a commercially available off-the-shelf processor, a fuzzing test method targeting the x86 processors was proposed [2], and a later work used an improved algorithm with better performance and reduced overhead [10]. Dofferhoff et al [11] presented a reduced instruction set computer (RISC) instruction scanner that is used to search for undocumented instructions on RISC architectures implemented on emulators.…”

iScanU: A Portable Scanner for Undocumented Instructions on RISC Processors

“…Therefore, the memcage method provides a more general way of scanning for undocumented instructions than provided by Domas. Xi et al [10] extend the work of Domas by further reducing the search space and associated efficiency gains. Like Domas' work, this extension only applies to x86 and an alternative to the trap flag is not proposed, which is one of the main contributions of our work.…”

“…[12] describes how the ARMv8 ISA is converted to machine readable format, used to create Verilog models for formal verification. Our system uses disassemblers as a ground truth for correct processor behavior, analog to previous work done for the x86 architecture [10], [13]. It should be noted that the disassembler may be inconsistent with the official ISA specification, although in practice the number of false positives due to disassembler bugs was small enough to make manual verification of the results viable.…”

“…In this work the ground truth is provided by disassemblers, analog to previous work done for the x86 architecture [10], [13]. For ARMv8 we use Capstone 4.0.1 [8].…”