1/10 Tweet storm on paper I co-authored with wu cache clan: arxiv.org/abs/1711.01254
2/10 Double fetch bugs are very difficult to fuzz and consequently mostly slow and complex analysis tools such as Bochspwn and xenpwn
3/10 has been used to Fuzz for df bugs. To understand the problem imagine a dumb fuzzer. It needs 2**x inputs to garantie full coverage
4/10 of the state space where x is the maximum number of relevant bits in the input.Obviously not all every input is equally likely
5/10 to yield a bug and there is space to optimize with start parameters and guiding However, if input can change over change over time
6/10 the state space increases to approx as 2**xt where t is the time. Thus, a fuzzer even one with
7/10 guidance will have a fair bit to chew on if we want to search for double fetch bugs. But we noticed flush+reload cache side channel
8/10 can be used to add guidance in the temporal dimension when fuzzing and thus take simple fuzzing to the tricky problem of
9/10 double fetch bugs. Obviously you can use this a first stage for more complex tools such as Bochspwn to combine coverage of
10/10 fuzzing with depth of analysis of Bochspwn.
