Sonar: A Hardware Fuzzing Framework to Uncover Contention Side Channels in Processors

Contention-based side channels, rooted in resource sharing, have emerged as a significant security threat in modern processors.These side channels allow attackers to leverage timing differences caused by conflicts in execution ports, caches, or interconnects to infer secret information such as cryptographic keys or enclave-resident data.Despite increasing awareness, detecting such channels remains challenging because triggering contentions requires precisely orchestrating specific microarchitectural states, which is often difficult in practice, especially for timing-sensitive contentions.This paper introduces Sonar, the first systematic and automated fuzzing framework designed to uncover contention side channels in processors.Our core idea is to leverage microarchitectural states to guide testcase generation, enabling the precise triggering of microarchitectural events with stringent conditions.Sonar is built on the key observation that multiplexers (MUXes) are hotspots for contention, as resource contention frequently involves data routing and signal selection, which are fundamentally implemented