  CPU cache is a limited but crucial storage component in modern processors,
whereas the cache timing side-channel may inadvertently leak information
through the physically measurable timing variance. Speculative execution, an
essential processor optimization, and a source of such variances, can cause
severe detriment on deliberate branch mispredictions. Despite static analysis
could qualitatively verify the timing-leakage-free property under speculative
execution, it is incapable of producing endorsements including inputs and
speculated flows to diagnose leaks in depth. This work proposes a new symbolic
execution based method, SpecuSym, for precisely detecting cache timing leaks
introduced by speculative execution. Given a program (leakage-free in
non-speculative execution), SpecuSymsystematically explores the program state
space, models speculative behavior at conditional branches, and accumulates the
cache side effects along with subsequent path explorations. During the dynamic
execution, SpecuSymconstructs leak predicates for memory visits according to
the specified cache model and conducts a constraint-solving based cache
behavior analysis to inspect the new cache behaviors. We have
implementedSpecuSymatop KLEE and evaluated it against 15 open-source
benchmarks. Experimental results show thatSpecuSymsuccessfully detected from 2
to 61 leaks in 6 programs under 3 different cache settings and identified false
positives in 2 programs reported by recent work.
