Revizor is a security-oriented fuzzer for detecting information leaks in CPUs, such as Spectre and Meltdown. It tests CPUs against Leakage Contracts and searches for unexpected leaks.
Get startedOverview
Speculative execution attacks such as Spectre and Meltdown exploit microarchitectural optimizations to leak information across security domains. These vulnerabilities often stay undetected for years because few tools exits for systematic analysis of CPUs to find them.
Revizor targets this problem by automatically testing for microarchitectural leakage in black-box CPUs. The key idea is to employ speculation contracts to model the expected information leaks, and then to use randomized testing to compare the CPU's leakage against the model and thus detect unexpected leaks.
Features
Finds unknown leaks in CPUs, automatically.
No special setup required; works on off-the-shelf PCs.
Detects a broad range of leaks: from classic side channels to speculative execution attacks, and more.
Fast detection: Spectre V1 detected in ~5 minutes, MDS in ~7 minutes.
Trophies
Newly discovered vulnerabilities:
- String Comparison Overrun (SCO): Revizor discovered that string operations on Intel and AMD CPUs (in particular, string comparison and string scan) can speculatively bypass the bounds of their target strings, which permits the attacker to leak data from out-of-bounds memory locations. (More details in Hide & Seek with Spectres)
- Zero Dividend Injection (ZDI): Revizor discovered that 64-bit division operation on Intel CPus can speculative ignore the upper bits of the divisor, thus producing an incorrect computational result. This speculation can potentially impact the security of cryptographic algorithms that use division to implement modulo operations. (More details in Hide & Seek with Spectres)
- Spectre Var: Revizor discovered that the original investigations of Spectre vulnerabilities missed one form of leakage, which we call Spectre Var. This form of leakage is caused by the race condition that appears when a speculative memory access is data-dependent on a variable-latency instruction. This race condition can expose the operands of the variable-latency instruction. (More details in the Revizor paper)
- Store-based Spectre V1: Several defense proposals (e.g., STT, KLEESpectre) assumed that stores do not modify the cache state until they retire. We used Revizor to validate this assumption, and discovered that is not true on recent Intel CPUs (e.g., CoffeeLake). (More details in the Revizor paper)
- Speculative Store with Forwarding: Revizor discovered that two consecutive loads from the same address can speculatively return two different values if one of them receives a forwarded value from a store while the other load experiences a speculative store bypass. This combination exposes more information to the attacker compared to the original store bypass. (More details in the appendix to the Revizor paper)