Channel (broadcasting)

Speculative execution

Computer network

Thread (computing)

Compiler

Parallel computing

Speculative multithreading

Programming language

Multithreading

Symbolic execution

Software

Interference (communication)

Computer science

Theoretical computer science

Computer security

Scalability

Database

Since the advent of Spectre, a number of counter-measures have been proposed and deployed. Rigorously reasoning about their effectiveness, however, requires a well-defined notion of security against speculative execution attacks, which has been missing until now.In this paper (1) we put forward speculative non-interference, the first semantic notion of security against speculative execution attacks, and (2) we develop Spectector, an algorithm based on symbolic execution to automatically prove speculative non-interference, or to detect violations.We implement Spectector in a tool, which we use to detect subtle leaks and optimizations opportunities in the way major compilers place Spectre countermeasures. A scalability analysis indicates that checking speculative non-interference does not exhibit fundamental bottlenecks beyond those inherited by symbolic execution.

Spectector: Principled Detection of Speculative Information Flows