00

RISCVuzz

Tool ☆ WATCH ⎘ SHARE

First seen 7/3/2026

Last seen 9/1/2026

Evidence 21 chunks

01

NEIGHBORHOOD

34 nodes · 48 edges

graph · RISCVuzz · depth=1

02

RELATIONSHIPS

35 connections

GhostWrite introduces → 100% 2e evidence

RISCVuzz discovers the GhostWrite vulnerability on the T-Head XuanTie C910 CPU.

Sandbox State Protection implements → 100% 2e evidence

RISCVuzz incorporates a sandbox to protect registers, memory, and control flow during instruction execution.

instruction sequence generation implements → 100% 2e evidence

RISCVuzz generates instruction sequences of varying lengths and types for fuzzing.

Alarm-Based Infinite Loop Prevention implements → 100% 2e evidence

RISCVuzz uses an alarm mechanism to break out of infinite loops in the sandbox.

Bottom-Up Instruction Space Exploration implements → 100% 2e evidence

RISCVuzz uses a bottom-up approach to gradually increase the covered instruction space based on instruction encoding.

T-Head XuanTie C906 CPU evaluates → 100% 2e evidence

RISCVuzz was evaluated on the T-Head XuanTie C906 CPU, finding halt-and-catch-fire vulnerabilities.

Sequence Length Scaling uses → 100% 2e evidence

RISCVuzz evaluates and uses different sequence lengths to optimize fuzzing performance.

Differential Fuzzing uses → 100% 2e evidence

RISCVuzz uses differential fuzzing to detect CPU vulnerabilities without golden models.

T-Head XuanTie C908 CPU evaluates → 100% 2e evidence

RISCVuzz was evaluated on the T-Head XuanTie C908 CPU, discovering halting instruction sequences.

RISCVuzz Client (C and RISC-V Assembly) ← part of 100% 2e evidence

The RISCVuzz Client is part of the RISCVuzz framework, receiving and running test cases on RISC-V CPUs.

RISCVuzz Server ← part of 100% 2e evidence

The RISCVuzz Server is part of the RISCVuzz framework, responsible for generating test cases and analyzing results.

Runner Sandbox ← part of 100% 2e evidence

The Runner Sandbox is part of the RISCVuzz client, providing integrity for executing arbitrary instructions.

Reproducer File introduces → 100% 2e evidence

RISCVuzz introduces the concept of logging reproducer files for found differences.

Instruction Encoding Space uses → 100% 2e evidence

RISCVuzz systematically explores the RISC-V instruction encoding space to find vulnerabilities.

Instruction Space Coverage uses → 100% 2e evidence

RISCVuzz aims to maximize instruction space coverage through its filtering and exploration techniques.

T-Head XuanTie C910 CPU evaluates → 100% 2e evidence

RISCVuzz was evaluated on the T-Head XuanTie C910 CPU, discovering GhostWrite.

Encoding-Based Instruction Filtering implements → 100% 2e evidence

RISCVuzz uses encoding-based filtering to selectively include/exclude ISA extensions and shrink the search space.

RISCVuzz: Discovering Architectural CPU Vulnerabilities via Differential Hardware Fuzzing ← introduces 100% 2e evidence

The paper introduces RISCVuzz as a novel differential CPU fuzzing framework for RISC-V CPUs.

RISC-V Opcodes Repository uses → 100% 2e evidence

RISCVuzz uses the RISC-V Opcodes repository for instruction classification and building filters.

Differential CPU Fuzzing implements → 100% 2e evidence

RISCVuzz implements differential CPU fuzzing to compare architectural results across different RISC-V CPUs.

SiFive U74 CPU evaluates → 95% 1e evidence

RISCVuzz was evaluated on the SiFive U74 CPU.

Prelude: Priming-Guided State Reconstruction for Efficient FPGA Processor Debugging ← mentions 85% 1e evidence

The paper cites RISCVuzz as related work on CPU vulnerability discovery.

Majority Vote Differential Analysis implements → 100% 1e evidence

RISCVuzz uses majority vote to identify deviations from expected architectural behavior across CPUs.

Static Binary Compilation for Noise Removal implements → 100% 1e evidence

RISCVuzz uses static compilation to remove noise from differences caused by shared libraries.

Lazy Page Mapping implements → 100% 1e evidence

RISCVuzz lazily maps pages when a segmentation fault occurs due to unmapped memory access.

post-silicon fuzzing implements → 100% 1e evidence

RISCVuzz is a post-silicon fuzzer that finds bugs on real hardware CPUs, complementing RTL fuzzing.

SiFive U54 CPU evaluates → 95% 1e evidence

RISCVuzz was evaluated on the SiFive U54 CPU.

Processor Fuzzing implements → 95% 1e evidence

RISCVuzz is a differential hardware fuzzing tool for RISC-V processors.

Nix Build System uses → 100% 1e evidence

RISCVuzz uses the Nix build system to ensure reproducible static builds of the client binary.

Halt-and-Catch-Fire CPU Vulnerability introduces → 100% 1e evidence

RISCVuzz discovers halt-and-catch-fire CPU vulnerabilities on C906 and C908.

Cascade ← compares with 100% 1e evidence

RISCVuzz is compared to the RTL fuzzer Cascade, showing orders of magnitude faster throughput on hardware.

DiFuzzRTL ← compares with 85% 1e evidence

RISCVuzz is compared to DifuzzRTL, another RTL fuzzer for RISC-V.

Fuzzing Throughput Optimization uses → 100% 1e evidence

RISCVuzz implements 3 optimizations for transfer to achieve high throughput fuzzing.

Multi-Core Fuzzing Parallelization uses → 100% 1e evidence

RISCVuzz can be deployed on multiple CPU cores to improve fuzzing throughput.

rvv-bench uses → 85% 1e evidence

RISCVuzz's paper uses rvv-bench to measure overhead when the vector extension is disabled as mitigation.