Abstract:Modern computing systems heavily rely on hardware as the root of trust. However, their increasing complexity has given rise to security-critical vulnerabilities that cross-layer at-tacks can exploit. Traditional hardware vulnerability detection methods, such as random regression and formal verification, have limitations. Random regression, while scalable, is slow in exploring hardware, and formal verification techniques are often concerned with manual effort and state explosions. Hardware fuzzing has emerged as an effective approach to exploring and detecting security vulnerabilities in large-scale designs like modern processors. They outperform traditional methods regarding coverage, scalability, and efficiency. However, state-of-the-art fuzzers struggle to achieve comprehensive coverage of intricate hardware designs within a practical timeframe, often falling short of a 70% coverage threshold. We propose a novel ML-based hardware fuzzer, ChatFuzz, to address this challenge. Ourapproach leverages LLMs like ChatGPT to understand processor language, focusing on machine codes and generating assembly code sequences. RL is integrated to guide the input generation process by rewarding the inputs using code coverage metrics. We use the open-source RISCV-based RocketCore processor as our testbed. ChatFuzz achieves condition coverage rate of 75% in just 52 minutes compared to a state-of-the-art fuzzer, which requires a lengthy 30-hour window to reach a similar condition coverage. Furthermore, our fuzzer can attain 80% coverage when provided with a limited pool of 10 simulation instances/licenses within a 130-hour window. During this time, it conducted a total of 199K test cases, of which 6K produced discrepancies with the processor's golden model. Our analysis identified more than 10 unique mismatches, including two new bugs in the RocketCore and discrepancies from the RISC-V ISA Simulator.

An Endeavor to Industrialize Hardware Fuzzing: Automating NoC Verification in UVM

NoCFuzzer: Automating NoC Verification in UVM

MorFuzz: Fuzzing Processor Via Runtime Instruction Morphing Enhanced Synchronizable Co-simulation.

FuzzWiz -- Fuzzing Framework for Efficient Hardware Coverage

The Fuzz Odyssey: A Survey on Hardware Fuzzing Frameworks for Hardware Design Verification

Industrial Oriented Evaluation of Fuzzing Techniques

HFuzz: Towards automatic fuzzing testing of NB-IoT core network protocols implementations

Industry Practice of Directed Kernel Fuzzing for Open-source Linux Distribution

Constructing Cyber-Physical System Testing Suites Using Active Sensor Fuzzing

Fuzz testing in practice: Obstacles and solutions

The Emergence of Hardware Fuzzing: A Critical Review of its Significance

Smart Fuzzing of 5G Wireless Software Implementation

Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing

Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware

NDFuzz: a non-intrusive coverage-guided fuzzing framework for virtualized network devices

A deep convolution generative adversarial networks based fuzzing framework for industry control protocols

Fw‐fuzz: A code coverage‐guided fuzzing framework for network protocols on firmware

Formal-Guided Fuzz Testing: Targeting Security Assurance from Specification to Implementation for 5G and Beyond

FieldFuzz: In Situ Blackbox Fuzzing of Proprietary Industrial Automation Runtimes via the Network

A Survey of Network Protocol Fuzzing: Model, Techniques and Directions

TaPaFuzz: Hardware-accelerated RISC-V bare-metal firmware fuzzing using rapid job launches