{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T23:17:05Z","timestamp":1784330225074,"version":"3.55.0"},"reference-count":65,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2016,10]]},"DOI":"10.1109\/micro.2016.7783743","type":"proceedings-article","created":{"date-parts":[[2016,12,19]],"date-time":"2016-12-19T17:11:05Z","timestamp":1482167465000},"page":"1-13","source":"Crossref","is-referenced-by-count":167,"title":["Jump over ASLR: Attacking branch predictors to bypass ASLR"],"prefix":"10.1109","author":[{"given":"Dmitry","family":"Evtyushkin","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dmitry","family":"Ponomarev","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nael","family":"Abu-Ghazaleh","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2016.2596287"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2014.25"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/1141277.1141364"},{"key":"ref32","first-page":"475","article-title":"Enhanced operating system security through efficient and fine-grained address space randomization","author":"giuffrida","year":"2012","journal-title":"Presented as part of the 21st USENIX Security Symposium (USENIX Security 12)"},{"key":"ref31","first-page":"339","article-title":"Address space layout permutation (ASLP): Towards fine-grained randomization of commodity software","author":"kil","year":"2006","journal-title":"IEEE Nul"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/2768566.2768571"},{"key":"ref37","article-title":"Innovative technology for CPU based attestation and sealing","volume":"13","author":"anati","year":"2013","journal-title":"Proceedings of the 2nd international workshop on hardware and architecturalsupport for security and privacy"},{"key":"ref36","year":"0","journal-title":"NVD CVE-ID CVE-2015-1158 Sep 6 2015"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/MM.2003.1196116"},{"key":"ref34","article-title":"Efficient techniques for comprehensive protection from memory error exploits","author":"bhatkar","year":"2005","journal-title":"Usenix Security"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2009.16"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/2857705.2857707"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.34"},{"key":"ref28","article-title":"Predicting secret keys via branch prediction","author":"aciicmez","year":"2007","journal-title":"The Cryptographers' Track at the RSA Conference"},{"key":"ref63","doi-asserted-by":"crossref","first-page":"191","DOI":"10.1109\/SP.2013.23","article-title":"Practical timing side channel attacks against kernel space ASLR","author":"hund","year":"2013","journal-title":"2013 IEEE Symposium on Security and Privacy SP"},{"key":"ref27","article-title":"On the power of simple branch prediction analysis","author":"aciicmez","year":"2007","journal-title":"Symposium on Information Computer and Communication Security (ASIACCS)"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.45"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813685"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/2870636"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/DISCEX.2000.821514"},{"key":"ref1","first-page":"14","article-title":"Smashing the stack for fun and profit","volume":"7","author":"one","year":"1996","journal-title":"Phrack Magazine"},{"key":"ref20","first-page":"1","article-title":"Apple iOS 4 security evaluation","author":"dai zovi","year":"2011","journal-title":"Black Hat USA"},{"key":"ref22","article-title":"return-to-libc attack","author":"designer","year":"1997","journal-title":"Bugtraq"},{"key":"ref21","article-title":"Too much PIE is bad for performance","author":"payer","year":"2012"},{"key":"ref24","first-page":"459","article-title":"kGuard: lightweight kernel protection against return-to-user attacks","author":"kemerlis","year":"2012","journal-title":"Presented as part of the 21st USENIX Security Symposium (USENIX Security 12)"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315313"},{"key":"ref26","article-title":"Revisiting iOS Kernel (In) Security: Attacking the early_random() PRNG","author":"mandt","year":"0"},{"key":"ref25","year":"0","journal-title":"KASLR An Exercise in Cargo Cult Security"},{"key":"ref50","author":"shamasunder","year":"2015","journal-title":"On the Effectiveness of Heterogeneous-ISA Program State Relocation against Return-Oriented Programming"},{"key":"ref51","doi-asserted-by":"crossref","first-page":"118","DOI":"10.1145\/2366231.2337173","article-title":"TimeWarp: rethinking timekeeping and performance monitoring mechanisms to mitigate side channel attacks","volume":"40","author":"martin","year":"2012","journal-title":"ACM SIGARCH Computer Architecture News"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/2897937.2897962"},{"key":"ref58","first-page":"719","article-title":"Flush+ reload: a high resolution, low noise, L3 cache side-channel attack","author":"yarom","year":"2014","journal-title":"23rd USENIX Security Symposium (USENIX Security 14)"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.43"},{"key":"ref56","first-page":"473","article-title":"Covert and side channels due to processor architecture","author":"wang","year":"2006","journal-title":"IEEE Nul"},{"key":"ref55","article-title":"Flush+ Flush: A Stealthier Last Level Cache Attack","author":"gruss","year":"2015","journal-title":"arXiv preprint arXiv 1511 05271"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/40.710872"},{"key":"ref53","doi-asserted-by":"crossref","DOI":"10.1145\/2487726.2487734","article-title":"Unraveling time warp: What all the fuzz is about?","author":"bhattacharya","year":"2013","journal-title":"Hardware and Architectural Support for Security and Privacy (HASP)"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.22"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA.2012.6237009"},{"key":"ref40","article-title":"Sanctum: Minimal hardware extensions for strong software isolation","author":"costan","year":"2016","journal-title":"25th USENIX Security Symposium (USENIX Security 16)"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2013.6522324"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/1030083.1030124"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/1998412.1998434"},{"key":"ref14","year":"0","journal-title":"NVD CVE-ID CVE-2015-3108 Sep 6 2015"},{"key":"ref15","article-title":"Non-control-data attacks are realistic threats","volume":"5","author":"chen","year":"2005","journal-title":"Usenix Security"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813694"},{"key":"ref17","article-title":"Address space layout randomization","year":"2003","journal-title":"Phrack"},{"key":"ref18","article-title":"Address space layout randomization in Windows Vista","volume":"26","author":"howard","year":"2006","journal-title":"Microsoft Corporation"},{"key":"ref19","article-title":"XNU: A security evaluation","author":"keuper","year":"2012"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2005.29"},{"key":"ref3","article-title":"Format string attacks","author":"newsham","year":"2000"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102151"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2005.36"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315314"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.41"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23287"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866370"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1006\/jpdc.1995.1014"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85451-7_17"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382216"},{"key":"ref47","article-title":"On the Effectiveness of Full-ASLR on 64-bit Linux","author":"marco-gisbert","year":"2014"},{"key":"ref42","article-title":"SCHED_SETAFFINITY(2) linux programme's manual","author":"kerrisk","year":"2015"},{"key":"ref41","doi-asserted-by":"crossref","DOI":"10.1109\/SP.2015.45","article-title":"Controlled-channel attacks: Deterministic side channels for untrusted operating systems","author":"xu","year":"2015"},{"key":"ref44","author":"kerrisk","year":"2015","journal-title":"proc(5) Linux Programmer's Manual"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.31"}],"event":{"name":"2016 49th Annual IEEE\/ACM International Symposium on Microarchitecture (MICRO)","location":"Taipei, Taiwan","start":{"date-parts":[[2016,10,15]]},"end":{"date-parts":[[2016,10,19]]}},"container-title":["2016 49th Annual IEEE\/ACM International Symposium on Microarchitecture (MICRO)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/7777315\/7783693\/07783743.pdf?arnumber=7783743","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,8,21]],"date-time":"2023-08-21T06:39:08Z","timestamp":1692599948000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/7783743\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,10]]},"references-count":65,"URL":"https:\/\/doi.org\/10.1109\/micro.2016.7783743","relation":{},"subject":[],"published":{"date-parts":[[2016,10]]}}}