Towards Reinforcement Learning for Exploration of Speculative Execution Vulnerabilities

TL;DR

This paper introduces SpecRL, a reinforcement learning framework designed to automatically discover speculative execution vulnerabilities in microprocessors, addressing the manual complexity and hardware knowledge barriers in existing methods.

Contribution

The paper presents a novel reinforcement learning-based approach for detecting speculative execution leaks in black-box microprocessors, reducing manual effort and hardware expertise needed.

Findings

Successfully identifies speculative leaks using SpecRL

Reduces manual labor in vulnerability discovery

Demonstrates effectiveness on post-silicon processors

Abstract

Speculative attacks such as Spectre can leak secret information without being discovered by the operating system. Speculative execution vulnerabilities are finicky and deep in the sense that to exploit them, it requires intensive manual labor and intimate knowledge of the hardware. In this paper, we introduce SpecRL, a framework that utilizes reinforcement learning to find speculative execution leaks in post-silicon (black box) microprocessors.