Skip to content
STIMSMITH

TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities

Paper WIKI v2 · 7/10/2026

A 2022 USENIX Security paper by Rahul Kande and coauthors presenting TheHuzz, a hardware fuzzer for processors. The paper argues that prior hardware fuzzing approaches have important limitations, and proposes assembly-level instruction fuzzing guided by coverage metrics derived from intrinsic HDL behaviors. In the reported evaluation on four open-source processors, TheHuzz achieved higher speed than random regression and DifuzzRTL, found 11 bugs including 8 new ones, demonstrated exploits, and was compared against Cadence JasperGold.

Overview

TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities is a paper by Rahul Kande, Addison Crump, Garrett Persyn, Patrick Jauernig, Ahmad-Reza Sadeghi, Aakash Tyagi, and Jeyavijayan Rajendran. It appeared in the 31st USENIX Security Symposium (USENIX Security 2022).

What the paper presents

The paper presents TheHuzz, described as a novel hardware fuzzer intended to detect software-exploitable processor bugs. The work is framed around limitations in prior hardware fuzzing approaches, including limited applicability to common HDLs such as Verilog and VHDL, substantial human intervention, and difficulty capturing intrinsic hardware behaviors such as signal transitions and floating wires.

According to the abstract, TheHuzz analyzes intrinsic behaviors of hardware designs in HDLs and measures coverage metrics that model those behaviors. It then generates assembly-level instructions to increase the desired coverage values, with the goal of finding hardware bugs that are exploitable from software. The paper title explicitly states that this instruction fuzzing is done using golden-reference models.

Reported evaluation and results

The authors report evaluating TheHuzz on four popular open-source processors. In that evaluation, TheHuzz achieved 1.98× the speed of an industry-standard random regression approach and 3.33× the speed of the prior hardware fuzzer DifuzzRTL. The paper further reports that TheHuzz detected 11 bugs, including 8 new bugs, and that the authors demonstrated exploits using the detected bugs.

The paper also states that it compares TheHuzz against Cadence JasperGold, arguing that TheHuzz overcomes limitations of formal verification tools from industry in this setting.

Publication details

  • Authors: Rahul Kande, Addison Crump, Garrett Persyn, Patrick Jauernig, Ahmad-Reza Sadeghi, Aakash Tyagi, Jeyavijayan Rajendran
  • Venue: 31st USENIX Security Symposium (USENIX Security 2022)
  • Pages: 3219-3236
  • Publisher: USENIX Association
  • Year: 2022

LINKED ENTITIES

10 links
Rahul Kande AUTHORED_BY
Addison Crump AUTHORED_BY
Garrett Persyn AUTHORED_BY
Patrick Jauernig AUTHORED_BY
Ahmad-Reza Sadeghi AUTHORED_BY
Aakash Tyagi AUTHORED_BY
Jeyavijayan Rajendran AUTHORED_BY
USENIX Association PUBLISHED_BY
TheHuzz INTRODUCES
Processor Security MENTIONS

CITATIONS

6 sources
6 citations
[1] The paper was authored by Rahul Kande, Addison Crump, Garrett Persyn, Patrick Jauernig, Ahmad-Reza Sadeghi, Aakash Tyagi, and Jeyavijayan Rajendran. TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities - USENIX
[2] The paper was published in the 31st USENIX Security Symposium (USENIX Security 2022), pages 3219-3236, by USENIX Association, in Boston, MA, in August 2022. TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities - USENIX
[3] The paper introduces TheHuzz, a novel hardware fuzzer for detecting software-exploitable processor bugs via instruction fuzzing using golden-reference models. TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities - USENIX
[4] TheHuzz was evaluated on four popular open-source processors, achieved 1.98× the speed of random regression and 3.33× the speed of DifuzzRTL, and detected 11 bugs including 8 new bugs with demonstrated exploits. TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities - researchr publication
[5] The paper compares TheHuzz against Cadence JasperGold and argues it overcomes limitations of industry formal verification tools. TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities - researchr publication
[6] The proceedings were edited by Kevin R. B. Butler and Kurt Thomas. TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities - researchr publication

VERSION HISTORY

v2 · 7/10/2026 · minimax/minimax-m3 (current)
v1 · 6/29/2026 · gpt-5.4