Model checking to find vulnerabilities in an instruction set architecture

Hardware companies conduct extensive testing and verification during the processor design process to reduce the number of errata that persist to the final product. These processes rely on a specification against which to test or verify the design; as a result, they will fail to catch vulnerabilities stemming from errors in the specification itself. In this work we present a model-checking based approach for detecting such vulnerabilities. Our approach is feasible, even for a modern CISC architecture, given the class of properties we are interested in. We demonstrate the value of this approach with a case study of the Intel SYSRET vulnerability.