corpus.blog
41554 blogs · [ { "id": "01a0879d-3e27-725f-a9ad-2b8794322348", "title": "Spectre on RISC-V Silicon: Attacks and Defenses on Commercial Out-of-Order Processors", "url": "https://lukasgerlach.me/publication/2026-speculative-execution-attacks-on-risc-v-silicon/", "published_at": "2026-08-12T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b87951d92f5", "title": "Spectre on RISC-V Silicon", "url": "https://lukasgerlach.me/blog/2026-spectre-on-riscv-silicon-usenix/", "published_at": "2026-07-03T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b8795db688d", "title": "How do Cache Attacks Against AES Work?", "url": "https://lukasgerlach.me/blog/aes-lookup-table-attacks/", "published_at": "2026-05-26T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b8796b651c2", "title": "Crucible: Retrofitting Commodity CPUs with Vulnerabilities via Transparent Software Emulation", "url": "https://lukasgerlach.me/publication/2026-crucible-retrofitting-commodity-cpus/", "published_at": "2026-05-18T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b8796dc47c4", "title": "TDXRay: Microarchitectural Side-Channel Analysis of Intel TDX for Real-World Workloads", "url": "https://lukasgerlach.me/publication/2026-tdxray-microarchitectural-side-channel-analysis/", "published_at": "2026-05-18T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879781681a", "title": "Zero-Store Elimination and its Implications on the SIKE Cryptosystem", "url": "https://lukasgerlach.me/publication/2026-zero-store-elimination-and-its-implications/", "published_at": "2026-02-03T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b8797dc7d15", "title": "RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs", "url": "https://lukasgerlach.me/publication/2025-riscover-automatic-discovery-of-user-exploitable/", "published_at": "2025-10-13T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b8797fb0507", "title": "Confusing Value with Enumeration: Studying the Use of CVEs in Academia", "url": "https://lukasgerlach.me/publication/2025-confusing-value-with-enumeration-studying-the/", "published_at": "2025-08-13T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b87986f9b67", "title": "SCASE: Automated Secret Recovery via Side-Channel-Assisted Symbolic Execution", "url": "https://lukasgerlach.me/publication/2025-scase-automated-secret-recovery-via-side/", "published_at": "2025-08-13T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b8798a3b891", "title": "Taming the Linux Memory Allocator for Rapid Prototyping", "url": "https://lukasgerlach.me/publication/2025-taming-the-linux-memory-allocator-for/", "published_at": "2025-07-09T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b8798b33ce4", "title": "Rapid Reversing of Non-Linear CPU Cache Slice Functions: Unlocking Physical Address Leakage", "url": "https://lukasgerlach.me/publication/2025-rapid-reversing-of-non-linear-cpu/", "published_at": "2025-05-12T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b8799b28d0c", "title": "Do Compilers Break Constant-time Guarantees?", "url": "https://lukasgerlach.me/publication/2025-do-compilers-break-constant-time-guarantees/", "published_at": "2025-04-14T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879aa6d88e", "title": "Lixom: Protecting Encryption Keys with Execute-Only Memory", "url": "https://lukasgerlach.me/publication/2025-lixom-protecting-encryption-keys-with-execute/", "published_at": "2025-04-14T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879b0a1381", "title": "Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting", "url": "https://lukasgerlach.me/publication/2025-cascading-spy-sheets-exploiting-the-complexity/", "published_at": "2025-02-23T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879bc48b43", "title": "ShadowLoad: Injecting State into Hardware Prefetchers", "url": "https://lukasgerlach.me/publication/2025-shadowload-injecting-state-into-hardware-prefetchers/", "published_at": "2025-01-03T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879be80af8", "title": "Peripheral Instinct: How External Devices Breach Browser Sandboxes", "url": "https://lukasgerlach.me/publication/2025-peripheral-instinct-how-external-devices-breach/", "published_at": "2025-01-01T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879c2580ee", "title": "No Leakage Without State Change: Repurposing Configurable CPU Exceptions to Prevent Microarchitectural Attacks", "url": "https://lukasgerlach.me/publication/2024-no-leakage-without-state-change-repurposing/", "published_at": "2024-12-09T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879d192d89", "title": "CacheWarp: Software-based Fault Injection using Selective State Reset", "url": "https://lukasgerlach.me/publication/2024-cache-warp/", "published_at": "2024-05-20T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879d7411e5", "title": "Efficient and Generic Microarchitectural Hash-Function Recovery", "url": "https://lukasgerlach.me/publication/2024-micro-hash/", "published_at": "2024-05-20T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879e499b5a", "title": "A Security RISC? The State of Microarchitectural Attacks on RISC-V", "url": "https://lukasgerlach.me/talk/a-security-risc-the-state-of-microarchitectural-attacks-on-risc-v/", "published_at": "2023-12-07T13:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879ecf78b1", "title": "Rowhammer Revisited: From Exploration to Exploitation and Mitigation", "url": "https://lukasgerlach.me/talk/rowhammer-revisited-from-exploration-to-exploitation-and-mitigation/", "published_at": "2023-12-02T13:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b879f906edb", "title": "A Rowhammer Reproduction Study Using the Blacksmith Fuzzer", "url": "https://lukasgerlach.me/publication/2023-rowhammer-reprod/", "published_at": "2023-10-06T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b87a048a447", "title": "Indirect Meltdown: Building Novel Side-Channel Attacks from Transient-Execution Attacks", "url": "https://lukasgerlach.me/publication/2023-reviving-meltdown-3a/", "published_at": "2023-10-06T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b87a0a607f7", "title": "Reviving Meltdown 3a", "url": "https://lukasgerlach.me/publication/2023-indirect-meltdown/", "published_at": "2023-10-06T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b87a12a8ae2", "title": "Collide+Power: Leaking Inaccessible Data with Software-based Power Side Channels", "url": "https://lukasgerlach.me/publication/2023-collide-power/", "published_at": "2023-08-09T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b87a1ba2422", "title": "Hammulator: Simulate Now-Exploit Later", "url": "https://lukasgerlach.me/publication/2023-hammulator/", "published_at": "2023-06-17T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b87a2003898", "title": "A Security RISC: Microarchitectural Attacks on Hardware RISC-V CPUs", "url": "https://lukasgerlach.me/publication/2023-security-risc/", "published_at": "2023-05-22T00:00:00+00:00" }, { "id": "01a0879d-3e27-725f-a9ad-2b87a2f9b5a3", "title": "CSAW Applied Research Competition Finalist", "url": "https://lukasgerlach.me/awards/2023-csaw-finalist/", "published_at": "2023-01-01T00:00:00+00:00" } ] posts Claim your blog
Back to lukasgerlach.me
Blog · corpus.blog/blogs/lukasgerlach.me/posts

lukasgerlach.me

lukasgerlach.me

2026

Spectre on RISC-V Silicon: Attacks and Defenses on Commercial Out-of-Order Processorsoriginal ↗
12 Aug 2026
Spectre on RISC-V Siliconoriginal ↗
3 Jul 2026
How do Cache Attacks Against AES Work?original ↗
26 May 2026
Crucible: Retrofitting Commodity CPUs with Vulnerabilities via Transparent Software Emulationoriginal ↗
18 May 2026
TDXRay: Microarchitectural Side-Channel Analysis of Intel TDX for Real-World Workloadsoriginal ↗
18 May 2026
Zero-Store Elimination and its Implications on the SIKE Cryptosystemoriginal ↗
3 Feb 2026

2025

RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUsoriginal ↗
13 Oct 2025
Confusing Value with Enumeration: Studying the Use of CVEs in Academiaoriginal ↗
13 Aug 2025
SCASE: Automated Secret Recovery via Side-Channel-Assisted Symbolic Executionoriginal ↗
13 Aug 2025
Taming the Linux Memory Allocator for Rapid Prototypingoriginal ↗
9 Jul 2025
Rapid Reversing of Non-Linear CPU Cache Slice Functions: Unlocking Physical Address Leakageoriginal ↗
12 May 2025
Do Compilers Break Constant-time Guarantees?original ↗
14 Apr 2025
Lixom: Protecting Encryption Keys with Execute-Only Memoryoriginal ↗
14 Apr 2025
Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprintingoriginal ↗
23 Feb 2025
ShadowLoad: Injecting State into Hardware Prefetchersoriginal ↗
3 Jan 2025
Peripheral Instinct: How External Devices Breach Browser Sandboxesoriginal ↗
1 Jan 2025

2024

No Leakage Without State Change: Repurposing Configurable CPU Exceptions to Prevent Microarchitectural Attacksoriginal ↗
9 Dec 2024
CacheWarp: Software-based Fault Injection using Selective State Resetoriginal ↗
20 May 2024
Efficient and Generic Microarchitectural Hash-Function Recoveryoriginal ↗
20 May 2024

2023

A Security RISC? The State of Microarchitectural Attacks on RISC-Voriginal ↗
7 Dec 2023
Rowhammer Revisited: From Exploration to Exploitation and Mitigationoriginal ↗
2 Dec 2023
A Rowhammer Reproduction Study Using the Blacksmith Fuzzeroriginal ↗
6 Oct 2023
Indirect Meltdown: Building Novel Side-Channel Attacks from Transient-Execution Attacksoriginal ↗
6 Oct 2023
Reviving Meltdown 3aoriginal ↗
6 Oct 2023
Collide+Power: Leaking Inaccessible Data with Software-based Power Side Channelsoriginal ↗
9 Aug 2023
Hammulator: Simulate Now-Exploit Lateroriginal ↗
17 Jun 2023
A Security RISC: Microarchitectural Attacks on Hardware RISC-V CPUsoriginal ↗
22 May 2023
CSAW Applied Research Competition Finalistoriginal ↗
1 Jan 2023