SpecFuzz Emerges To Test Code For Spectre-Style Vulnerabilities

Fuzzing is an important means of finding unintended/invalid behavior within software and now there exists a fuzzer for providing Spectre-type vulnerabilities.

SpecFuzz is a new tool for uncovering possible Spectre vulnerabilities within source code. When compiling the software under test paired with extra instrumentation is able to uncover possible Spectre Variant One vulnerabilities in source code as a result of mispredictions by simulating speculative execution within this fuzzer.

This is the first fuzzer we are aware of focused on finding speculative execution issues. SpecFuzz is open-source via GitHub.

SpecFuzz was presented at FOSDEM 2020 and there is the WebM video recording of the presentation along with the PDF slide deck.