ExfilState: Automated Discovery of Timer-Free Cache Side Channels on ARM CPUs
Fabian Thomas, Michael Torres, Daniel Moghimi, Michael Schwarz
2025Year
3Top-tier citations
Abstract
Microarchitectural attacks and reverse-engineering efforts rely on inferring the cache state of cache lines. While high-resolution timers traditionally enable this, such timers are increasingly restricted or unavailable to unprivileged users on modern ARM64 systems.
Ask about this paper
Your agent reads all of it.
Lune indexed this paper to the last equation, along with the top-tier papers that cite it. Ask a question and the answer quotes them.
Your agent calls
Luneget_paper_fulltext
Free to start. No credit card required.
Terminal
Install the CLIlune papers fulltext 8cd3427a-ab3b-498d-9f88-98b34f893efcCited by top-tier papers3
- TDXRay: Microarchitectural Side-Channel Analysis of Intel TDX for Real-World WorkloadsTristan Hornetz, Hosein Yavarzadeh, Albert Cheu, Adrià Gascón et al.S&P 2026 · 5 citations
- RISCy Cache Coherence: Timer-Free Architectural Cache Attacks via Instruction/Data Cache IncoherenceFabian Thomas, Michael SchwarzS&P 2026 · 1 citation
- RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUsFabian Thomas, Eric García Arribas, Lorenz Hetterich, Daniel Weber et al.CCS 2025
Builds on35
- Spectre Attacks: Exploiting Speculative ExecutionPaul Kocher, Jann Horn, Anders Fogh, Daniel Genkin et al.S&P 2019 · 2,435 citations
- DRAMA: Exploiting DRAM Addressing for Cross-CPU AttacksPeter Pessl, Daniel Gruss, Clémentine Maurice, Michael Schwarz et al.USENIX Security 2016 · 500 citations
- ARMageddon: Cache Attacks on Mobile DevicesMoritz Lipp, Daniel Gruss, Raphael Spreitzer, Clémentine Maurice et al.USENIX Security 2016 · 451 citations
- A Systematic Evaluation of Transient Execution Attacks and DefensesClaudio Canella, Jo Van Bulck, Michael Schwarz, Moritz Lipp et al.USENIX Security 2019 · 442 citations
- Telling Your Secrets without Page Faults: Stealthy Page Table-Based Attacks on Enclaved ExecutionJo Van Bulck, Nico Weichbrodt, Rüdiger Kapitza, Frank Piessens et al.USENIX Security 2017 · 316 citations
Related papers
- Osiris: Automated Discovery of Microarchitectural Side ChannelsDaniel Weber, Ahmad Ibrahim, Hamed Nemati, Michael Schwarz et al.USENIX Security 2021 · 75 citations
- GhostCache: Timer- and Counter-Free Cache Attacks Exploiting Weak Coherence on RISC-V and ARM ChipsYu Jin, Minghong Sun, Dongsheng Wang, Pengfei Qiu et al.CCS 2025
- IdleLeak: Exploiting Idle State Side Effects for Information LeakageFabian Rauscher, Andreas Kogler, Jonas Juffinger, Daniel GrussNDSS 2024
- I See Dead µops: Leaking Secrets via Intel/AMD Micro-Op CachesXida Ren, Logan Moody, Mohammadkazem Taram, Matthew Jordan et al.ISCA 2021 · 59 citations
- Sonar: A Hardware Fuzzing Framework to Uncover Contention Side Channels in ProcessorsKanqi Zhang, Peinan Li, Miao Li, Xin Tian et al.MICRO 2025 · 2 citations
