ReFuzz: Reusing Tests for Processor Fuzzing with Contextual Bandits

2025-12-03

AI Summary

Processor iterative design often leads to recurrence of similar vulnerabilities across generations and multi-core architectures, yet existing fuzzing tools cannot effectively leverage historical vulnerability data to guide new testing. This paper proposes the first contextual bandit–based adaptive processor fuzzing framework, introducing historical vulnerability-triggering test cases into hardware fuzzing for the first time. By learning contextual features of historically effective inputs, the framework dynamically selects and mutates test cases to enable cross-generation vulnerability reuse detection. Experimental results demonstrate substantial improvements in testing efficiency and coverage: average coverage speed increases by 511.23×, and total coverage exceeds 9.33%. The approach discovers three previously unknown security vulnerabilities—including one cross-platform flaw affecting multiple shared-module processors—and two novel functional defects.

Technology Category

• Machine Learning: Hardware-aware ML
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Federated Web and WoT systems, including distributed, federated and edge-based data processing

Abstract

Processor designs rely on iterative modifications and reuse well-established designs. However, this reuse of prior designs also leads to similar vulnerabilities across multiple processors. As processors grow increasingly complex with iterative modifications, efficiently detecting vulnerabilities from modern processors is critical. Inspired by software fuzzing, hardware fuzzing has recently demonstrated its effectiveness in detecting processor vulnerabilities. Yet, to our best knowledge, existing processor fuzzers fuzz each design individually, lacking the capability to understand known vulnerabilities in prior processors to fine-tune fuzzing to identify similar or new variants of vulnerabilities. To address this gap, we present ReFuzz, an adaptive fuzzing framework that leverages contextual bandit to reuse highly effective tests from prior processors to fuzz a processor-under-test (PUT) within a given ISA. By intelligently mutating tests that trigger vulnerabilities in prior processors, ReFuzz effectively detects similar and new variants of vulnerabilities in PUTs. ReFuzz uncovered three new security vulnerabilities and two new functional bugs. ReFuzz detected one vulnerability by reusing a test that triggers a known vulnerability in a prior processor. One functional bug exists across three processors that share design modules. The second bug has two variants. Additionally, ReFuzz reuses highly effective tests to enhance efficiency in coverage, achieving an average 511.23x coverage speedup and up to 9.33% more total coverage, compared to existing fuzzers.

Problem

• Detects processor vulnerabilities by reusing effective tests from prior designs
• Identifies similar and new variants of vulnerabilities in modern processors
• Enhances fuzzing efficiency and coverage through intelligent test mutation

Innovation

• Adaptive fuzzing framework using contextual bandits
• Reuses effective tests from prior processors intelligently
• Mutates tests to detect similar and new vulnerabilities