  Spectre attacks disclosed in early 2018 expose data leakage scenarios via
cache side channels. Specifically, speculatively executed paths due to branch
mis-prediction may bring secret data into the cache which are then exposed via
cache side channels even after the speculative execution is squashed. Symbolic
execution is a well-known test generation method to cover program paths at the
level of the application software. In this paper, we extend symbolic execution
with modelingof cache and speculative execution. Our tool KLEESPECTRE, built on
top of the KLEE symbolic execution engine, can thus provide a testing engine to
check for the data leakage through cache side-channel as shown via Spectre
attacks. Our symbolic cache model can verify whether the sensitive data leakage
due to speculative execution can be observed by an attacker at a given program
point. Our experiments show that KLEESPECTREcan effectively detect data leakage
along speculatively executed paths and our cache model can further make the
leakage detection much more precise.
