{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,11,13]],"date-time":"2026-11-13T18:07:33Z","timestamp":1794593253095,"version":"4.9.1"},"reference-count":55,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100003130","name":"FWO","doi-asserted-by":"publisher","award":["1261222N"],"award-info":[{"award-number":["1261222N"]}],"id":[{"id":"10.13039\/501100003130","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100011878","name":"Flemish Government","doi-asserted-by":"publisher","award":["VOEWICS02"],"award-info":[{"award-number":["VOEWICS02"]}],"id":[{"id":"10.13039\/501100011878","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","award":["101020005"],"award-info":[{"award-number":["101020005"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000266","name":"Engineering and Physical Sciences Research Council","doi-asserted-by":"publisher","award":["EP\/X03738X\/1,EP\/V000454\/1,EP\/R012598\/1"],"award-info":[{"award-number":["EP\/X03738X\/1,EP\/V000454\/1,EP\/R012598\/1"]}],"id":[{"id":"10.13039\/501100000266","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00052","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"4391-4407","source":"Crossref","is-referenced-by-count":11,"title":["Battering RAM: Low-Cost Interposer Attacks on Confidential Computing via Dynamic Memory Aliasing"],"prefix":"10.1109","author":[{"given":"Jesse","family":"De Meulemeester","sequence":"first","affiliation":[{"name":"KU Leuven,COSIC,Leuven,Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Oswald","sequence":"additional","affiliation":[{"name":"University of Birmingham & Durham University,United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ingrid","family":"Verbauwhede","sequence":"additional","affiliation":[{"name":"KU Leuven,COSIC,Leuven,Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jo","family":"Van Bulck","sequence":"additional","affiliation":[{"name":"KU Leuven,DistriNet,Leuven,Belgium"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2017.10"},{"key":"ref2","first-page":"487","article-title":"An off-chip attack on hardware enclaves via the memory bus","volume-title":"29th USENIX Security Symposium","author":"Lee","year":"2020"},{"key":"ref3","first-page":"717","article-title":"CIPHERLEAKS: Breaking constant-time cryptography on AMD SEV via the ciphertext side channel","volume-title":"30th USENIX Security Symposium","author":"Li","year":"2021"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833768"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00104"},{"key":"ref6","article-title":"Supporting Intel SGX on multi-socket platforms","volume-title":"White Paper, ID 843058","author":"Johnson","year":"2021"},{"key":"ref7","volume-title":"Undermining integrity features of SEV-SNP with memory aliasing","year":"2024"},{"key":"ref8","article-title":"SEV secure nested paging firmware ABI specification","volume-title":"Tech. Rep. 56860, Rev. 1.57","year":"2025"},{"key":"ref9","article-title":"A memory encryption engine suitable for general purpose processors","author":"Gueron","year":"2016","journal-title":"IACR Cryptology ePrint Archive"},{"key":"ref10","volume-title":"AMD SEV-SNP: Strengthening VM isolation with integrity protection and more","year":"2020"},{"key":"ref11","first-page":"699","article-title":"VoltPillager: Hardware-based fault injection attacks against Intel SGX enclaves using the SVID voltage scaling interface","volume-title":"30th USENIX Security Symposium","author":"Chen","year":"2021"},{"key":"ref12","article-title":"BADFET: Defeating modern secure boot using SecondOrder pulsed electromagnetic fault injection","volume-title":"11th USENIX Workshop on Offensive Technologies (WOOT 17)","author":"Cui","year":"2017"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484779"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2023.i2.1-23"},{"key":"ref15","first-page":"6239","article-title":"Oops\u2025! i glitched it again! how to Multi-Glitch the Glitching-Protections on ARM TrustZoneM","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Sa\u00df","year":"2023"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24499"},{"key":"ref17","volume-title":"Supporting Intel SGX on multi-package platforms","author":"Johnson","year":"2025"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/2487726.2488368"},{"key":"ref19","volume-title":"Architecture specification: Intel trust domain extensions (Intel TDX) module","year":"2023"},{"key":"ref20","author":"Kaplan","year":"2016","journal-title":"AMD memory encryption"},{"key":"ref21","author":"Kaplan","year":"2017","journal-title":"Protecting VM register state with SEV-ES"},{"key":"ref22","article-title":"Arm CCA security model","volume-title":"Tech. Rep. Arm DEN 0096, Version 1.0","year":"2021"},{"key":"ref23","volume-title":"Intel hardware shield - Intel total memory encryption"},{"key":"ref24","volume-title":"\u201cIntel architecture memory encryption technologies,\u201d Intel, Manual 336907-004US, Rev. 1.4","year":"2022"},{"key":"ref25","first-page":"565","article-title":"DRAMA: Exploiting DRAM addressing for cross-CPU attacks","volume-title":"25th USENIX Security Symposium","author":"Pessl","year":"2016"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218599"},{"key":"ref27","volume-title":"DDR4 SDRAM","year":"2017"},{"key":"ref28","volume-title":"DDR4 registering clock driver definition (DDR4RCD02)","year":"2023"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/HST.2016.7495582"},{"key":"ref30","volume-title":"Tweezer Attack","author":"Brew Wiki","year":"2023"},{"key":"ref31","article-title":"pin2pwn: How to root an embedded Linux box with a sewing needle","author":"Dixon","year":"2016","journal-title":"DEF CON 24"},{"key":"ref32","author":"Cojocar","year":"2021","journal-title":"mFIT: A bump-in-the-wire tool for plug-and-play analysis of rowhammer susceptibility factors"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.46586\/uasc.2025.001"},{"key":"ref34","article-title":"Intel Xeon scalable processors: NEX eagle stream platform, Intel platform security","volume-title":"Tech. Rep. 784473","year":"2023"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.5555\/3277203.3277277"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00020"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354252"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00089"},{"key":"ref39","author":"Van Schaik","year":"2020","journal-title":"SGAxe: How SGX fails in practice"},{"key":"ref40","author":"Scarlata","year":"2018","journal-title":"Supporting third party attestation for Intel SGX with Intel data center attestation primitives"},{"key":"ref41","article-title":"ZenHammer: Rowhammer attacks on AMD Zen-based platforms","volume-title":"33rd USENIX Security Symposium","author":"Jattke","year":"2024"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3029806.3029836"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3193111.3193112"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/SPW53761.2021.00063"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00079"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690317"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3652597"},{"key":"ref48","article-title":"Arm realm management extension (RME) system architecture","volume-title":"Tech. Rep. Arm DEN 0129, Version B.a","year":"2023"},{"key":"ref49","article-title":"Learn the architecture - introducing Arm confidential compute architecture","volume-title":"Tech. Rep. Arm DEN 0125, Version 3.0","year":"2023"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW67616.2025.00056"},{"key":"ref51","volume-title":"DDR5 SDRAM","year":"2020"},{"key":"ref52","first-page":"275","article-title":"Scalable memory protection in the PENGLAI enclave","volume-title":"15th USENIX Symposium on Operating Systems Design and Implementation (OSDI)","author":"Feng","year":"2021"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2018.00041"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3173162.3177155"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3188146"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573462.pdf?arnumber=11573462","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:27:28Z","timestamp":1782970048000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573462\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":55,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00052","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}