English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Security critical software, e.g., OpenSSL, comes with numerous side-channelleakages left unpatched due to a lack of resources or experts. The situationwill only worsen as the pace of code development accelerates, with developersrelying on Large Language Models (LLMs) to automatically generate code. In thiswork, we explore the use of LLMs in generating patches for vulnerable code withmicroarchitectural side-channel leakages. For this, we investigate thegenerative abilities of powerful LLMs by carefully crafting prompts following azero-shot learning approach. All generated code is dynamically analyzed byleakage detection tools, which are capable of pinpointing information leakageat the instruction level leaked either from secret dependent accesses orbranches or vulnerable Spectre gadgets, respectively. Carefully crafted promptsare used to generate candidate replacements for vulnerable code, which are thenanalyzed for correctness and for leakage resilience. From a cost/performanceperspective, the GPT4-based configuration costs in API calls a mere few centsper vulnerability fixed. Our results show that LLM-based patching is far morecost-effective and thus provides a scalable solution. Finally, the framework wepropose will improve in time, especially as vulnerability detection tools andLLMs mature.

ZeroLeak: Using LLMs for Scalable and Cost Effective Side-Channel Patching