vusec / inspectre-gadget

InSpectre Gadget: in-depth inspection and exploitability analysis of Spectre disclosure gadgets
https://vusec.github.io/inspectre-gadget/
Apache License 2.0
37 stars 3 forks source link

Handle secret addresses that requires memory leak #4

Open AlviseDeFaveri opened 8 months ago

AlviseDeFaveri commented 8 months ago

When the secret address is in the form of

LOAD[uncontrolled] + controlled

We currently mark the secret_address_control as REQUIRES_MEM_LEAK, but in the reasoner we only consider valid secret addresses when secret_address_control is CONTROLLED.

Ideal solution would be splitting the secret address in a controlled and uncontrolled part, as we do for the base.