Reflections on the Experimental Evaluation of a Binary-Level Symbolic Analyzer for Spectre

Abstract

execution. A well-known analysis technique that scales well on binary code is symbolic execution (SE) [4], [5]. In order to analyze speculative constant-time, it must be adapted to additionally consider transient execution introduced by the speculative semantics. However, modeling these new behaviors explicitly does not scale because it quickly leads to state explosion. Therefore, the challenge is to optimize this exploration in order to make the analysis applicable to real code.Proposal. In our paper, "Hunting the Haunter-Efficient Relational Symbolic Execution for Spectre with Haunted RelSE" [6], we proposed a novel technique, Haunted RelSE, to model speculative behaviors more efficiently, and detect Spectre-PHT and Spectre-STL vulnerabilities. We implemented it in a new static analyzer for binary-code, called BINSEC/HAUNTED and evaluated it on small examples and on real-world cryptographic code. In summary, we proposed the following contributions:• We design a dedicated technique on top of relational symbolic execution, named Haunted RelSE, which key idea is to model transient and sequential (in order) behavior at the same time; • We propose a verification tool, BINSEC/HAUNTED, implementing Haunted RelSE and perform an experimental evaluation on 1) a well-known litmus tests (small test cases) for Spectre-PHT, 2) a new set of litmus tests for Spectre-STL that we propose, 3) on real-world cryptographic code. We also compare against two state of the art tools, KLEESpectre [7] and Pitchfork [3]; • Finally, we report new Spectre-STL violations concerning index-masking-a countermeasure against Spectre-PHT, and PIC options [8] from the gcc compiler.

Sound Symbolic Execution via Abstract Interpretation and its Application to Security

“…Relational symbolic execution. In order to apply SE to security properties such as noninterference, Milushev et al [32] propose a form of relational symbolic execution (RSE) to use KLEE to analyze noninterference by means of a technique called selfcomposition [7,20,39] to reduce a relational property of a program p to a safety property of a transformation of p. More recently, Daniel et al have optimized RSE to be applicable to binary code to analyze relational properties such as constant time [17] and speculative constant time [18,19] and discovered violations of these properties in realworld cryptographic libraries. All these approaches are based on pure (relational) SE static techniques and, as such, they are not capable of recovering soundness beyond a fixed bound as in our case.…”