From Silicon to Boot Code: Extending Automated Program Repair to Firmware-Layer Security Workarounds
TL;DR
This work studies the feasibility of extending to this firmware layer a dictionary- guided, localize-synthesize-validate APR methodology originally developed for RTL repair, and frames these results within a broader research agenda for a unified hardware-to-firmware correctness lifecycle.
Abstract
Automated program repair (APR) research has been constrained to design time. Current techniques localize and fix bugs in Register- Transfer Level (RTL) or High Level Synthesis (HLS) designs before a chip reaches production. Once a hardware vulnerability surfaces post-silicon, the patch content must be manually generated. Exist- ing automation methods address patch deployment but not patch synthesis. Based on established pre-silicon APR methods, we study the feasibility of extending to this firmware layer a dictionary- guided, localize-synthesize-validate APR methodology originally developed for RTL repair. An automated commit-clustering miner surfaces recurring fix templates across the EDK II (UEFI) firmware repository’s full commit history without depending on previously known Common Vulnerabilities and Exposures (CVE) identifiers, recovering all three known CVE-fix campaigns and surfacing two additional candidate bug families. Grounding our detectors in real fix evidence, we build four independent localizers: missing specu- lation barriers in C (CVE-2017-5753, Spectre v1), missing bounds checks before array writes in C (decompression library CVE), miss- ing Return Stack Buffer (RSB)-stuffing macro calls in x86 assembly (CVE-2017-5715), and missing integer-overflow guards in Hand-Off Block (HOB) creation C code (surfaced by the miner itself). All four achieve 100% recall; precision ranges from 2.1–15.5% on the C families to 100% on the assembly and HOB families. We perform root-cause analysis for the C-family false positives mechanically, which attributes 77–90% to two intra-procedural causes, isolating the inter-procedural alias-analysis gap as a measured 15–20% rather than an estimate. A held-out test confirms Spectre v1 localization holds at 100% recall on unseen files; a fifth, independently built dictionary entry (CVE-2018-3630) shows the methodology extends to a new bug signature at low added cost; and a naive syntactic baseline recalls at most 14% where our targeted detector recalls 100%. We frame these results within a broader research agenda for a unified hardware-to-firmware correctness lifecycle