Hardware companies conduct extensive testing and verification during the processor design process to reduce the number of errata that persist to the final product. These processes rely on a specification against which to test or verify the design; as a result, they will fail to catch vulnerabilities stemming from errors in the specification itself. In this work we present a model-checking based approach for detecting such vulnerabilities. Our approach is feasible, even for a modern CISC architecture, given the class of properties we are interested in. We demonstrate the value of this approach with a case study of the Intel SYSRET vulnerability.
['Chris Bradfield', 'Cynthia Sturton']
Model checking to find vulnerabilities in an instruction set architecture