Search papers, labs, and topics across Lattice.
TEERepair, a novel framework, automates the repair of TEE partitioning vulnerabilities by using a domain-specific language (DSL) to encode security patterns and patch templates. Large language models (LLMs) are then employed to reason about code semantics and synthesize context-aware patches, which are validated through generated test clients. Experiments on the PartitioningE-Bench show a repair success rate of 87.6%, and real-world applications led to the merging of 2 out of 5 submitted repair pull requests.
LLMs can now automatically fix critical security vulnerabilities in Trusted Execution Environments with high success rates, even without standardized development guidelines.
Trusted Execution Environments (TEEs) provide hardware-based isolation to protect sensitive data and computations from potentially compromised operating systems (OS). However, TEE applications inevitably interact with the untrusted OS through SDK interfaces, and improper partitioning can introduce severe vulnerabilities such as data leakage and code injection. While prior work has proposed static analysis tools to detect such issues, automated repair remains largely unexplored. This problem is particularly challenging due to three TEE-specific factors: the lack of standardized secure development guidelines, the difficulty of extracting semantic information from low-level C code, and the absence of mature testing and validation methods. In this work, we present TEERepair, a framework for automatically repairing bad partitioning issues in TEE applications. Our approach tackles the above challenges by introducing a domain-specific language (DSL) to encode repair rules that express and capture common TEE security patterns, which are instantiated as patch templates with placeholders for context-specific variables. We then leverage large language models (LLMs) to reason about code semantics and synthesize context-aware patches, and further generate test clients to validate the repairs. We evaluate TEERepair on the TEE Partitioning Errors Benchmark (PartitioningE-Bench), achieving a significantly higher repair success rate of 87.6% compared to baselines. Furthermore, applying TEERepair to real-world TEE projects, we submitted 5 repair pull requests, 2 of which have been confirmed and merged by project maintainers.
