EXTp: A Soundness Theorem for Counterfactual Exploit Replay on Formally Verified Microkernels

{"Counterfactual":[0,64],"exploit":[1],"analysis":[2],"--":[3,13,68],"determining":[4],"which":[5],"input":[6],"parameter":[7],"causally":[8],"produced":[9],"an":[10],"observed":[11],"outcome":[12],"is":[14,23],"pervasive":[15],"in":[16,79],"security":[17],"research,":[18],"but":[19],"its":[20,191],"current":[21],"practice":[22],"epistemically":[24],"unsound.":[25],"Three":[26],"gaps":[27],"separate":[28],"\\"different":[29],"outcome\\"":[30],"from":[31],"\\"caused":[32],"by":[33],"the":[34,49,63,69,117,171,182,187],"change\\":":[35],"non-deterministic":[36],"replay":[37,57],"noise,":[38],"replay-machinery":[39],"side-effects,":[40],"and":[41,62,123,153,159,185],"causal":[42,76,139],"pathways":[43],"traversing":[44],"microarchitectural":[45],"state":[46],"invisible":[47],"to":[48],"analyst's":[50],"surface.":[51],"We":[52],"present":[53],"EXTp,":[54],"a":[55,80],"counterfactual":[56,75],"framework":[58,188],"on":[59,116,170,176],"bare-metal":[60,154,177],"seL4,":[61],"Soundness":[65],"Theorem":[66],"(CST)":[67],"first":[70],"formal":[71],"soundness":[72,148],"theorem":[73],"for":[74],"attribution":[77,140],"grounded":[78],"verified":[81],"microkernel":[82],"substrate.":[83],"EXTp":[84],"realizes":[85],"three":[86],"observable":[87],"properties:":[88],"Capability":[89],"Separation":[90],"(Pearl":[91],"modularity;":[92],"Clopper-Pearson":[93,111],"bound":[94,115],"<=":[95,121],"0.37%":[96],"at":[97],"N=998),":[98],"Strong":[99],"Observational":[100],"Equivalence":[101],"(replay":[102],"determinism:":[103],"score_S":[104],"=":[105],"1.0000":[106],"over":[107],"N=34":[108],"cross-boot":[109],"trials,":[110],"one-sided":[112],"95%":[113],"upper":[114],"per-run":[118],"failure":[119],"rate":[120,131],"10.4%),":[122],"Measurement":[124],"Interference":[125],"(calibrated":[126],"timing":[127],"threshold,":[128],"realized":[129],"false-positive":[130],"0.61%-2.78%).":[132],"CST":[133,145],"proves":[134],"their":[135],"composition":[136],"grounds":[137],"Pearl/Halpern-Pearl":[138],"within":[141],"enumerated":[142],"epistemic":[143],"bounds;":[144],"v1.0":[146],"establishes":[147],"under":[149],"single-VCPU":[150],"intervention":[151],"scope":[152],"microcode-stable":[155],"configurations,":[156],"with":[157],"multi-VCPU":[158],"cross-configuration":[160],"extensions":[161],"charted":[162],"as":[163],"future":[164],"work.":[165],"A":[166],"synthetic":[167],"analog":[168],"modeled":[169],"CrackArmor":[172],"confused-deputy":[173],"pattern,":[174],"executed":[175],"Intel":[178],"Alder":[179],"Lake,":[180],"exercises":[181],"pipeline":[183],"end-to-end":[184],"shows":[186],"correctly":[189],"detecting":[190],"own":[192],"A1-modulo":[193],"violations.":[194]}