After an embargo of 256 days, I'm happy to reveal our newest work: we present TREVEX, a black-box CPU fuzzer that detects transient execution vulnerabilities in an automated manner. Running TREVEX on AMD, Intel, and Zhaoxin CPUs discovered multiple new CPU vulnerabilities!
After an embargo of 256 days, I'm happy to reveal our newest work: we present TREVEX, a black-box CPU fuzzer that detects transient execution vulnerabilities in an automated manner. Running TREVEX on AMD, Intel, and Zhaoxin CPUs discovered multiple new CPU vulnerabilities!
We're [1] disclosing StackWarp, a CPU vulnerability allowing complete AMD SEV VM takeovers!
The project was lead by @Rayiizzz, who is also on the academic job market, so hit him up if u want research like this on your campus!
[1] @Rayiizzz, T. Hornetz, me, @fth0mas, @misc0110
For more details on the discovery process and our findings, we refer to our research paper, which is published at USENIX Security 2026.
paper: https://t.co/Z8ozxKUqIv
github: https://t.co/9guHTl8lDu
\cc Tristan Hornetz, @weber_daniel, @fth0mas, @misc0110
Today we reveal StackWarp: a new CPU vulnerability exploiting a synchronization bug in AMD’s stack engine across Zen 1–5 CPUs. It enables deterministic manipulation of Confidential VM's stack pointer, allowing RCE and privilege escalation via both control- and data-flow hijacking
@LTrampert@jovanbulck@misc0110 Using Athena, you can create PoC attacks without needing to care about your target's implementation or memory layout!
Paper: https://t.co/RXilMbSnWk
Code: https://t.co/do4PZTpAoR
PS: I'm available for hire soon, so ping me if you're at USENIX and know exciting opportunities!
@LTrampert@jovanbulck@misc0110 Automation is the key to further bridge the gap between academic research and practical side-channel attacks! Thus, we automate side-channel attacks by leveraging a symbolic execution engine.
@LTrampert and I just gave a talk at Black Hat Asia showing how CSS can be abused to deanonymize you when opening an email!
cc: @BlackHatEvents#BHASIA25
Heading to Black Hat Asia now! @LTrampert and I will give a briefing about deanonymizing users not only on the web but also in their email clients! #BHASIA
Here comes another fantastic talk—get ready!
"Beauty at a Cost: Privacy Implications of CSS on the Web and in Emails.“ by @LTrampert and @weber_daniel.
🌐 #RuhrSec Website
https://t.co/JmInxVVm6o
📖 RuhrSec Program
https://t.co/9WEuzGwD0q
#itsecurity#itsicherheit
@____salmon____@jan__reineke@misc0110@CISPA In "No Leakage Without State Change", we propose to shift away from monitoring entire systems for malicious processes towards enabling high-profile processes to monitor their own behavior to detect the influences of microarchitectural attacks.
Details: https://t.co/HYlfOdDwSn
Super excited to present our (L. Niemann, @____salmon____, @jan__reineke, @misc0110) newest paper at #ACSAC2024! We show how modern CPU hardware can be leveraged to stop side-channel attacks almost instantly (~200 CPU cycles)!
Code/Paper: https://t.co/EEBfQ3uFTC