camera-ready

InSpectre Gadget Results

analysis date: 20-02-2024
reasoner date: 26-02-2024
target: Linux Kernel 6.6-rc4

To reproduce, run scripts/run-queries.sh. This will create gadgets.db and print some stats.

General Stats

+--------------------------+--------------------+
|  "Exploitable Gadgets"   | COUNT(DISTINCT pc) |
+--------------------------+--------------------+
| Exploitable Gadgets      | 1511               |
| Reachable Targets        | 14015              |
| Exploitable Call Gadgets | 922                |
| Exploitable Jump Gadgets | 589                |
+--------------------------+--------------------+

Exploitable Gadgets

+------------------------+-----------------------+-------+---------------+--------------------------+-----------------------------------+------------------------+------------------------+------------------------------------------+-----------------------------------+-----------------------------+------------+--------------------+---------------------------+--------------------------+-------------------+-----------------------+
|          type          |      transmitter      | total | no_techniques | requires_prime_and_probe | is_secret_below_cache_granularity | is_secret_entropy_high | is_max_secret_too_high | is_max_secret_too_high_incl_high_entropy | base_has_direct_secret_dependency | leak_secret_near_valid_base | non_linear | sliding_and_prefix | sliding_and_base_overflow | prefix_and_base_overflow | in_place_training | out_of_place_training |
+------------------------+-----------------------+-------+---------------+--------------------------+-----------------------------------+------------------------+------------------------+------------------------------------------+-----------------------------------+-----------------------------+------------+--------------------+---------------------------+--------------------------+-------------------+-----------------------+
| call targets           | TransmitterType.LOAD  | 710   | 12            | 190                      | 73                                | 391                    | 7                      | 65                                       | 46                                | 0                           | 575        | 0                  | 1                         | 85                       | 452               | 39                    |
| call targets           | TransmitterType.STORE | 283   | 4             | 118                      | 30                                | 123                    | 0                      | 27                                       | 63                                | 0                           | 245        | 0                  | 1                         | 61                       | 204               | 10                    |
| reachable call targets | TransmitterType.LOAD  | 211   | 1             | 50                       | 33                                | 104                    | 4                      | 26                                       | 20                                | 0                           | 197        | 0                  | 2                         | 23                       | 164               | 13                    |
| reachable call targets | TransmitterType.STORE | 75    | 3             | 53                       | 5                                 | 14                     | 0                      | 6                                        | 49                                | 0                           | 70         | 0                  | 2                         | 20                       | 63                | 2                     |
| jump targets           | TransmitterType.LOAD  | 469   | 0             | 126                      | 221                               | 120                    | 0                      | 75                                       | 13                                | 0                           | 298        | 0                  | 0                         | 166                      | 166               | 115                   |
| jump targets           | TransmitterType.STORE | 160   | 0             | 13                       | 51                                | 94                     | 0                      | 43                                       | 1                                 | 0                           | 137        | 0                  | 0                         | 46                       | 53                | 57                    |
+------------------------+-----------------------+-------+---------------+--------------------------+-----------------------------------+------------------------+------------------------+------------------------------------------+-----------------------------------+-----------------------------+------------+--------------------+---------------------------+--------------------------+-------------------+-----------------------+