ZeroLeak: Automated Side-Channel Patching in Source Code Using LLMs

Security-critical software comes with numerous side-channel leakages left unpatched due to a lack of resources or experts. The situation will only worsen as the pace of code development accelerates, with developers relying on Large Language Models (LLMs) to automatically generate code. Compiler-based approaches are limited to only certain types of leakages and languages, and there is no automated method to solve the issue in the source code. In this work, we explore the use of LLMs in generating patches for vulnerable code with microarchitectural side-channel leakages in the source code. Automatic patching with LLMs in the source code provides portability to interpreted languages as well, eases the maintenance burden on the developers, and provides flexibility for different types of leakages. For this, we investigate the abilities of LLMs by carefully crafting prompts to generate candidate replacements for vulnerable code, which are then analyzed for correctness and leakage resilience. We dynamically analyze the generated code using leakage detection tools, which are capable of pinpointing information leakage at the instruction level leaked either from secret dependent accesses or branches or vulnerable Spectre gadgets, respectively. After extensive experimentation, we determined that the way prompts are formed and stacked over a series of queries plays a critical role in the LLMs’ ability to generate correct and leakage-free patches. We develop a number of tricks to improve the chances of correct and side-channel secure code. We show that side-channel vulnerabilities can be fixed using GPT-4 with a cost of a few cents per vulnerability fixed. Finally, our proposed framework will improve over time, especially as vulnerability detection tools and LLMs mature.