µVM A microarchitectural Intermediate Language for Speculative Execution Testing - Oliveira, José L. N. C. de; Dutra, Diego L. C. (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg.2026.26915, 2026)
Spectre Branch Target Injection (BTI) is a microarchitectural attack that exploits branch predictors to leak secrets across security domains. While implementation remains tightly coupled to the OS and processor, these vulnerabilities affect x86, ARM, and RISC-V architectures, despite a research bias toward x86 Linux. To cover the largest number of testing scenarios for this type of vulnerability, we present µVM, a microarchitectural intermediate language for speculative execution testing, which we use to test Linux, Windows, x86, and ARM. The framework was also capable of finding 2 bugs in the Linux kernel and undocumented behaviours in Intel CPUs.