Spectector: Principled Detection of Speculative Information Flows

Marco Guarnieri, Boris Kopf, Jose F. Morales, Jan Reineke, Andres Sanchez
2020 2020 IEEE Symposium on Security and Privacy (SP)  
Since the advent of SPECTRE, a number of countermeasures have been proposed and deployed. Rigorously reasoning about their effectiveness, however, requires a well-defined notion of security against speculative execution attacks, which has been missing until now. In this paper (1) we put forward speculative non-interference, the first semantic notion of security against speculative execution attacks, and (2) we develop SPECTECTOR, an algorithm based on symbolic execution to automatically prove
more » ... eculative noninterference, or to detect violations. We implement SPECTECTOR in a tool, which we use to detect subtle leaks and optimizations opportunities in the way major compilers place SPECTRE countermeasures. A scalability analysis indicates that checking speculative non-interference does not exhibit fundamental bottlenecks beyond those inherited by symbolic execution.
doi:10.1109/sp40000.2020.00011 dblp:conf/sp/GuarnieriKMRS20 fatcat:oe6dnq62pzhmhj7g6pkzyfx62y