Lost in Translation: Enabling Confused Deputy Attacks on EDA Software...
summary
Claims a practical attack chain: a new fuzzer TRANSFUZZ differentially fuzzes RTL across multiple simulators and synthesizers to find translation bugs, yielding 31 new bugs (25 CVEs) including 20 translation vulnerabilities in four open‑source EDA tools. Those bugs become MIRTL gadgets that reliably flip logic or hide backdoors so verification reports pass but synthesized silicon is malicious. Demonstrations include a hardened backdoor in the CVA6 RISC‑V core and an exploited external IP in an OpenTitan root‑of‑trust.
AI-written summary · about
chapters (10)
- 0:00EDA software vulnerabilities
- 2:40Unsoundness in EDA tools
- 5:33Threat models for hardware
- 6:37Translation bugs in synthesizers
- 8:48Finding translation bugs
- 10:57Leveraging translation bugs
- 12:44Why translation bugs evade detection
- 13:26Backdoor in CVA6 CPU
- 14:51Malicious IP in OpenTitan
- 15:56Conclusion and defense
related talks
32mSecSi Product Development
44mSilicon Under Attack Physical Exploitation Of Modern Chips
42mCPU Fuzzing: Automatic Discovery of...
50mD2T2 - Exposing Hidden Exploitable Behaviors Using EDF
21mOpen Source IC Design and Hardware Reverse Engineering Or: How I Learned to Stop...
38mAlice in Kernel Land: Lessons Learned From the eBPF Rabbit Hole
24mSystem Level Security Verification of RISC V Based SoCs
53mThree Colours of Fuzzing: Reflections and Open Challenges