CPU Fuzzing: Automatic Discovery of...
summary
Automated toolchain searches CPU behavior and reports concrete primitives and exploits: Osiris fuzzes three-instruction sequences to find timing side channels and rediscovers known ones plus four new side channels in four days, including a millisecond KASLR break using CLFLUSH plus non‑temporal moves; Transynther mutates Meltdown-style patterns and finds ~100 leakage patterns, seven distinct transient‑execution attacks and one new ZombieLoad‑style vuln that can exfiltrate an OpenSSL private key; MSRevelio scans MSRs and finds thousands of undocumented entries, some exposing mitigations or enabling new risks, while prototypes remain limited by short sequence length and noisy CPU state.
AI-written summary · about
chapters (20)
- 0:00Microarchitectural attacks intro
- 1:51Researchers and mission
- 3:18CPUs leaking secrets?
- 6:08CPU microarchitecture basics
- 8:59Cache side channels
- 11:27Manual review fails
- 12:54Fuzzing side channels idea
- 17:54Discovered side channel example
- 20:01Automating side channel discovery
- 21:49Kernel ASLR break
- 25:18Live Kernel ASLR break demo
- 26:01Fuzzing limits
- 27:07Automating transient attacks
- 30:20Fuzzing Meltdown attacks
- 31:2226 hours fuzzing results
- 32:50ZombieLoad attack
- 33:56What the tool reveals about CPU security
- 34:38Undocumented CPU features
- 37:47Undocumented MSRs risks
- 39:12Conclusion and future
related talks
53mResearching New Attack Interfaces On iOS And OSX
50mWhat the Fuzz
51mExploiting Hardware Glitches And Side Channels In Perfect Software
28mComplexity Killed Security
53mThree Colours of Fuzzing: Reflections and Open Challenges
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
34m1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution.
39mEL3XIR: Fuzzing COTS Secure Monitors