Instruction Fuzzing

Instruction fuzzing is a technique for testing processors by generating or mutating instruction sequences and observing the resulting behavior. In the provided evidence, it appears in two closely related forms: (1) fuzzing processors with assembly-level instruction streams to increase coverage and uncover software-exploitable hardware vulnerabilities, and (2) using instruction fuzzing together with operand mutation and statistical analysis to explore undocumented microarchitectural behavior. [arxiv-TheHuzz][arxiv-Plumber]

Technique overview

A representative instantiation is TheHuzz, which presents instruction fuzzing of processors using golden-reference models. TheHuzz analyzes hardware-intrinsic behaviors in HDL designs and uses coverage metrics intended to capture behaviors such as signal transitions, FSM behavior, and floating wires. It then generates assembly-level instructions to increase desired coverage values and tests instruction sequences in order to find bugs that software can exploit. The paper also describes a built-in optimizer that selects instructions and mutation techniques to improve coverage. [arxiv-TheHuzz]

More broadly, the provided evidence shows that instruction fuzzing is not limited to functional bug hunting. In Plumber, instruction fuzzing is combined with instruction-operand mutation and statistical analysis to explore undocumented microarchitectural optimizations and derive leakage templates for cache-based side channels. [arxiv-Plumber]

Reference implementation: TheHuzz

TheHuzz was introduced by Rahul Kande, Addison Crump, Garrett Persyn, Patrick Jauernig, Ahmad-Reza Sadeghi, Aakash Tyagi, and Jeyavijayan Rajendran at the 31st USENIX Security Symposium (USENIX Security 22), held in Boston, MA, August 10–12, 2022. The paper appears on pages 3219–3236 of the USENIX proceedings (ISBN 978-1-939133-31-1) and was edited by Kevin R. B. Butler and Kurt Thomas. [chunk-5c00b9d0][chunk-3104d973]

The work is positioned as a response to limitations in earlier hardware fuzzing and hardware verification approaches. According to the TheHuzz paper, simply applying software fuzzers to hardware misses hardware-intrinsic behaviors in HDLs such as signal transitions, FSMs, and floating wires. The paper also positions its approach as addressing shortcomings in prior hardware fuzzing proposals, including incomplete support for common HDLs, strong reliance on human intervention, and difficulty capturing certain hardware behaviors. [arxiv-TheHuzz]

Because the inputs are instruction sequences, instruction fuzzing naturally targets bugs that are reachable from software. In the TheHuzz formulation, this is explicitly framed as finding software-exploitable hardware vulnerabilities by executing the instruction sequences that trigger them. [arxiv-TheHuzz]

Reported properties in TheHuzz

In the cited paper, TheHuzz is described as:

• supporting commonly used HDLs such as Verilog and VHDL,
• fitting conventional industry-standard IC design and verification flows,
• detecting software-exploitable hardware vulnerabilities,
• accounting for different hardware behaviors,
• not requiring prior knowledge of the design, and
• scaling to large designs. [arxiv-TheHuzz]

These properties are claims about the TheHuzz implementation as reported in its paper, not necessarily about every instruction-fuzzing system. [arxiv-TheHuzz]

Reported results

The arxiv abstract of TheHuzz reports evaluation on four popular open-source processors, with 11 detected bugs, including 8 new vulnerabilities, and demonstrates exploits using the detected bugs. It also reports speedups of 1.98x over an industry-standard random regression approach and 3.33x over DiffuzRTL. The paper additionally compares its findings to those produced by the Cadence JasperGold formal verification tool to show that TheHuzz overcomes limitations of that tool. [arxiv-TheHuzz]

Scope of the technique in the provided evidence

Based on the evidence here, instruction fuzzing should be understood as a processor-focused fuzzing approach where the primary test inputs are instructions or instruction sequences. The cited uses show two main goals:

1. Processor vulnerability discovery through coverage-guided execution of generated instruction streams, as in TheHuzz. [arxiv-TheHuzz]
2. Microarchitectural behavior exploration for side-channel analysis, as in Plumber, where Plumber uses a combination of instruction fuzzing, instruction-operand mutation, and statistical analysis to derive sufficient conditions on vulnerable code inputs that can trigger distinguishing behavior, and re-identified a prefetcher-based vulnerability in OpenSSL 1.1.0g first reported by Shin et al. [arxiv-Plumber]

The evidence supports instruction fuzzing as a practical technique for exploring processor implementations from a software-visible interface while still targeting hardware and microarchitectural effects. [arxiv-TheHuzz][arxiv-Plumber]