News for hackers. Stuff that matters.

A comment on Multiple OS Vendors Release Security Patches After Misinterpreting Intel Docs. Parent comment

Re:Multiple OS Vendors Release Security Patches After Misint... by sillysaurus3 on Thursday May 10, 2018 @08:22AM (#17038179)
Why can't there be automated test suites that catch unauthorized access issues before ship (if not before merge commit)?

Usually the search space is too large.

[ Parent | on HN ]
Re:Multiple OS Vendors Release Security Patches After Misint... by rocqua on Thursday May 10, 2018 @09:47AM (#17038777)
Isn't that what fuzzing is for?
[ Parent | on HN ]
Re:Multiple OS Vendors Release Security Patches After Misint... by hedora on Thursday May 10, 2018 @10:49AM (#17039302)
Concolic testing would probably catch it, but only if the person that implemented the hardware model for the theorem prover understood the Intel documentation, which seems unlikely.

Basic fuzzing probably wouldn’t catch this; as the other comments point out, the search space is probably too large, and the set of vulnerable executions is probably too small for an undirected random search.

[ Parent | on HN ]
Re:Multiple OS Vendors Release Security Patches After Misint... by amluto on Thursday May 10, 2018 @10:15AM (#17039007)
I’d be truly amazed if a fuzzer could have caught this one. You need to invoke debug syscalls with the right parameters and the do a magic two-to-three instruction sequence.
[ Parent | on HN ]
Re:Multiple OS Vendors Release Security Patches After Misint... by learningto on Thursday May 10, 2018 @10:20AM (#17039046)
It's what formal verification is for!
[ Parent | on HN ]