MorFuzz
MorFuzz: Fuzzing Processor via Runtime Instruction Morphing Enhanced Synchronizable Co-simulation
32nd USENIX Security Symposium (USENIX Security 23) 2023
Paper Code@inproceedings{xu2023morfuzz, title = {MorFuzz: Fuzzing processor via runtime instruction morphing enhanced synchronizable co-simulation}, author = {Xu, Jinyan and Liu, Yiyuan and He, Sirui and Lin, Haoran and Zhou, Yajin and Wang, Cong}, booktitle = {32nd USENIX Security Symposium (USENIX Security 23)}, pages = {1307–1324}, year = {2023} }
MorFuzz is a processor fuzzer for RISC-V CPUs that finds software-triggerable hardware bugs before tape-out. It generates instruction streams from the processor’s runtime state, runs them on the RTL design in simulation, and checks the results against a reference model.
Challenges
Applying fuzzing to processors runs into three problems:
- Complex input grammar. Processors support many instructions, each expecting different kinds of operands (integers, floating-point numbers, addresses). Fuzzers that generate and mutate instructions statically produce few meaningful programs.
- Misleading coverage feedback. Jumps and branches can skip mutated instructions, so useful mutations are discarded because they never ran.
- Implementation differences. A software reference model is not the same as hardware, and not every mismatch is a bug. These false positives stop fuzzers from reaching deep processor states.
Approach
- Stimulus template. A new input structure that mutates inputs at three levels: processor state, instruction fields, and program semantics.
- Instruction morphing. MorFuzz collects context from the processor at runtime and mutates instructions on the fly, so they have valid formats and meaningful semantics. Because every mutation is executed, coverage reflects its real effect.
- Synchronizable co-simulation. MorFuzz extends co-simulation to different microarchitectures and synchronizes state between the RTL design and the reference model, so implementation differences are not reported as bugs.
Results
MorFuzz was evaluated on three open-source RISC-V processors: CVA6, Rocket, and BOOM.
- Found 17 new bugs, with 13 CVEs assigned.
- Reached 4.4× more state coverage than DifuzzRTL and 1.6× more than riscv-dv.
| Target | Bug | CVE / Issue |
|---|---|---|
| Rocket | aes64ks1i with rcon greater than 0xA treated as valid |
CVE-2022-34632 |
| Rocket | Error in the condition of the rocc_illegal signal |
Issue #2980 |
| Rocket | vsstatus.xs is writable |
CVE-2022-34627 |
| BOOM | Incorrect exception type on a PMA violation | CVE-2022-34636 |
| BOOM | Incorrect exception type on a PMP violation | CVE-2022-34641 |
| BOOM | Floating-point instruction with invalid rm field does not raise an exception |
Issue #458 |
| BOOM | Floating-point instruction with invalid frm does not raise an exception |
Issue #492 |
| CVA6 | Crafted or malformed sfence.vma instructions are executed |
CVE-2022-34633 |
| CVA6 | Crafted or malformed dret instructions are executed |
CVE-2022-34634 |
| CVA6 | Non-standard fence instructions treated as illegal |
CVE-2022-34639 |
| CVA6 | mstatus.sd does not update immediately |
CVE-2022-34635 |
| CVA6 | Incorrect mtval/stval after ecall/ebreak |
CVE-2022-34640 |
| CVA6 | Incorrect exception type on a PMA violation | CVE-2022-34636 |
| CVA6 | Incorrect exception type on a PMP violation | CVE-2022-34641 |
| CVA6 | Incorrect exception type when accessing an illegal virtual address | CVE-2022-34637 |
| CVA6 | Improper physical PC truncation | Issue #901 |
| CVA6 | Incorrect lr exception type |
CVE-2022-37182 |
| Spike | mcontrol.action uses an incorrect mask |
CVE-2022-34642 |
| Spike | Incorrect exception priority when accessing memory | CVE-2022-34643 |