SpecDoctor

Tool

First seen 6/13/2026

Last seen 7/30/2026

Evidence 8 chunks

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

13 connections

DiFuzzRTL ← compares with 85% 2e

Both SpecDoctor and DifuzzRTL are RTL fuzzers for CPU verification using differential fuzzing, making them comparable tools in the same domain.

SpecDoctor utilizes differential testing to detect sensitive data leakage.

PORTRUSH ← uses 95% 1e

PORTRUSH combines with SpecDoctor to monitor whether transient execution is successfully triggered.

The SpecDoctor paper introduces the SpecDoctor tool as an automated RTL fuzzer to discover transient execution vulnerabilities.

Differential Fuzzing implements → 97% 1e

SpecDoctor uses differential fuzz testing to find transient execution vulnerabilities.

RTL Fuzzing implements → 97% 1e

SpecDoctor is an automated RTL fuzzer targeting transient execution vulnerabilities.

SpecDoctor employs a multi-phase random instruction generation process for transient execution bug detection.

Fuzzing Template uses → 98% 1e

SpecDoctor designs a fuzzing template allowing it to test all transient execution vulnerability scenarios with a single template.

SpecDoctor is designed to find transient execution vulnerabilities in CPUs.

BOOM (RISC-V CPU) evaluates → 99% 1e

SpecDoctor was evaluated on the BOOM out-of-order RISC-V CPU.

NutShell-Argo CPU evaluates → 99% 1e

SpecDoctor was evaluated on the NutShell-Argo out-of-order RISC-V CPU.

Side-Channel Attack mentions → 93% 1e

SpecDoctor discovered a Spectre-type attack with a port contention side channel in NutShell CPU.

Multi-phased Fuzzing implements → 98% 1e

SpecDoctor performs multi-phased fuzzing where each phase addresses an individual vulnerability constraint.