{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,28]],"date-time":"2026-10-28T16:52:16Z","timestamp":1793206336047,"version":"4.5.0"},"reference-count":78,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100006785","name":"Google","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100006785","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100007736","name":"AWS","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100007736","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000780","name":"European Union","doi-asserted-by":"publisher","award":["101141972"],"award-info":[{"award-number":["101141972"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100018693","name":"Horizon Europe","doi-asserted-by":"publisher","award":["101120962"],"award-info":[{"award-number":["101120962"]}],"id":[{"id":"10.13039\/100018693","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003246","name":"NWO","doi-asserted-by":"publisher","award":["024.006.037"],"award-info":[{"award-number":["024.006.037"]}],"id":[{"id":"10.13039\/501100003246","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100010663","name":"European Research Council","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100010663","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00063","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"1558-1574","source":"Crossref","is-referenced-by-count":4,"title":["Rain: Transiently Leaking Data from Public Clouds Using Old Vulnerabilities"],"prefix":"10.1109","author":[{"given":"Math\u00e9","family":"Hertogh","sequence":"first","affiliation":[{"name":"Vrije Universiteit Amsterdam"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dave","family":"Quakkelaar","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Thijs","family":"Raymakers","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mahesh Hari","family":"Sarma","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marius","family":"Muench","sequence":"additional","affiliation":[{"name":"University of Birmingham"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Herbert","family":"Bos","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Erik","family":"Van der Kouwe","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00002"},{"key":"ref2","article-title":"Meltdown: reading kernel memory from user space","author":"Lipp","year":"2018","journal-title":"USENIX Security"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243761"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00089"},{"key":"ref5","article-title":"Retbleed: Arbitrary speculative code execution with return instructions","author":"Wikner","year":"2022","journal-title":"USENIX Security"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417289"},{"key":"ref7","article-title":"Foreshadow: Extracting the keys to the Intel SGX kingdom with transient out-of-order execution","author":"Van Bulck","year":"2018","journal-title":"USENIX Security"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00087"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363219"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354252"},{"key":"ref11","article-title":"Branch History Injection: On the Effectiveness of Hardware Mitigations Against Cross-Privilege Spectre-v2 Attacks","author":"Barberis","year":"2022","journal-title":"USENIX Security"},{"key":"ref12","article-title":"InSpectre Gadget: Inspecting the Residual Attack Surface of Cross-privilege Spectre v2","author":"Wiebing","year":"2024","journal-title":"USENIX Security"},{"key":"ref13","volume-title":"Foreshadow-ng: Breaking the virtual memory abstraction with transient out-of-order execution","author":"Weisse","year":"2018"},{"key":"ref14","volume-title":"The brutal performance impact from mitigating the LVI vulnerability","author":"Larabel","year":"2020"},{"key":"ref15","volume-title":"Core scheduling"},{"key":"ref16","volume-title":"Spectre vulnerability: 4 years after discovery","year":"2022"},{"key":"ref17","volume-title":"Linus torvalds growing frustrated by buggy hardware, theoretical cpu attacks","author":"Torvalds","year":"2024"},{"key":"ref18","article-title":"Protecting against the new \u201c11tf","author":"Turner","year":"2018","journal-title":"speculative vulnerabilities"},{"key":"ref19","volume-title":"Linus torvalds on current meltdown\/spectre patches \u201csomebody is pushing complete garbage for unclear reasons.\u201d","author":"Torvalds","year":"2018"},{"key":"ref20","volume-title":"Linux kernel mailing list [patch 0\/7] ibrs patch series","author":"Torvalds","year":"2018"},{"key":"ref21","volume-title":"New apple cpu side-channel attacks steal data from browsers","author":"Toulas"},{"key":"ref22","volume-title":"Researchers expose new intel cpu flaws enabling memory leaks and spectre v2 attacks","author":"Lakshmanan"},{"key":"ref23","article-title":"Intel fixes a security flaw it said was repaired six months ago, asks researchers to not reveal flaws despite grace period","author":"Zetter","year":"2019","journal-title":"New York Times"},{"key":"ref24","volume-title":"XSA-289 - Xen Security Advisories","author":"Manthey","year":"2019"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-64322-8_15"},{"key":"ref26","volume-title":"11tf-demo","author":"Stecklina","year":"2019"},{"key":"ref27","volume-title":"General-purpose machine family for Compute Engine","author":"Cloud"},{"key":"ref28","volume-title":"Amazon EC2 Instance types"},{"key":"ref29","volume-title":"KVM: x86: use array_index_nospec with indices that come from guest","author":"Raymakers","year":"2025"},{"key":"ref30","volume-title":"Project Rain: L1TF","author":"Hertogh","year":"2025"},{"key":"ref31","volume-title":"Amazon EC2 defenses against L1TF Reloaded","author":"Saidi","year":"2025"},{"key":"ref32","article-title":"FLUSH+ RELOAD: A high resolution, low noise, L3 cache side-channel attack","author":"Yarom","year":"2014","journal-title":"USENIX Security"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00004"},{"key":"ref34","volume-title":"Cache Missing for Fun and Profit","author":"Percival","year":"2005"},{"key":"ref35","first-page":"897","article-title":"Cache Template Attacks: Automating Attacks on Inclusive Last-Level Caches","volume-title":"Proceedings of the 24th USENIX Security Symposium, ser. SEC \u201915","author":"Gruss"},{"key":"ref36","article-title":"Spectre Returns! Speculation Attacks Using the Return Stack Buffer","author":"Koruyeh","year":"2018","journal-title":"WOOT"},{"key":"ref37","volume-title":"CVE-2018\u20133639, Spectre Variant 4: Speculative Store Bypass (SSB)","year":"2018"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29959-0_14"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00020"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363194"},{"key":"ref41","volume-title":"L1 terminal fault"},{"key":"ref42","volume-title":"L1 terminal fault"},{"key":"ref43","volume-title":"Affected Processors: Guidance for Security Issues on Intel Processors"},{"key":"ref44","volume-title":"L1D Flushing"},{"key":"ref45","volume-title":"Core scheduling","author":"Corbet","year":"2019"},{"key":"ref46","article-title":"A systematic evaluation of transient execution attacks and defenses","author":"Canella","year":"2019","journal-title":"USENIX Security"},{"key":"ref47","volume-title":"Microarchitectural Data Sampling (Disclosure Documentation 758366, v3)","year":"2021"},{"key":"ref48","volume-title":"Pteditor","author":"Schwarz"},{"key":"ref49","volume-title":"Intel. 2023. Intel\u00ae 64 and IA-32 Architectures Software Developer\u2019s Manual, Combined Volumes: 1, 2A, 2B, 2C, 2D, 3A, 3B, 3C, 3D, and 4","year":"2023"},{"key":"ref50","volume-title":"Linux Memory Management"},{"key":"ref51","article-title":"Half&Half: Demystifying Intel\u2019s Directional Branch Predictors for Fast, Secure Partitioned Execution","author":"Yavarzadeh","year":"2023","journal-title":"IEEE S&P"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00066"},{"key":"ref53","volume-title":"The EC2 approach to preventing side-channels"},{"key":"ref54","volume-title":"Finding gadgets for CPU side-channels with static analysis tools","author":"Zomer"},{"key":"ref55","volume-title":"Smatch check for Spectre stuff","author":"Carpenter"},{"key":"ref56","article-title":"SpecFuzz: Bringing spectre-type vulnerabilities to the surface","author":"Oleksenko","year":"2020","journal-title":"USENIX Security"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24466"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.24221"},{"key":"ref59","volume-title":"KVM: x86: Extend Spectre-v1 mitigation","author":"Pomonis"},{"key":"ref60","article-title":"ret2dir: Rethinking kernel isolation","author":"Kemerlis","year":"2014","journal-title":"USENIX Security"},{"key":"ref61","volume-title":"Exclusive page-frame ownership","author":"Corbet","year":"2016"},{"key":"ref62","volume-title":"Keeping secrets in memfd areas","author":"Corbet"},{"key":"ref63","volume-title":"Process-local memory allocations for hiding KVM secrets","author":"Hillenbrand","year":"2024"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833726"},{"key":"ref65","volume-title":"Improve Security with Address Space Isolation (ASI)","author":"Chartre","year":"2019"},{"key":"ref66","volume-title":"[RFC PATCH 00\/47] Address Space Isolation for KVM","author":"Shahid","year":"2022"},{"key":"ref67","volume-title":"[PATCH 00\/26] Address Space Isolation (ASI)","author":"Jackman","year":"2024"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607248"},{"key":"ref69","first-page":"7179","article-title":"Downfall: Exploiting speculative data gathering","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Moghimi","year":"2023"},{"key":"ref70","article-title":"Enter, exit, page fault, leak: Testing isolation boundaries for microarchitectural leaks","volume-title":"2026 IEEE Symposium on Security and Privacy","author":"Oleksenko","year":"2026"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17143-7_5"},{"key":"ref72","article-title":"Web Browser Tampering: Inspecting CPU Features from Side-Channel Information","author":"Saito","year":"2017","journal-title":"Broadband and Wireless Computing, Communication and Applications"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/SANER50967.2021.00036"},{"key":"ref74","volume-title":"spectre-meltdown-checker","author":"Lesimple"},{"key":"ref75","volume-title":"mdstool-cli"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359837"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/NETSOFT.2019.8806712"},{"key":"ref78","volume-title":"Retpoline: A Software Construct for Preventing Branch-Target-Injection","author":"Turner","year":"2018"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573429.pdf?arnumber=11573429","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:31:04Z","timestamp":1782970264000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573429\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":78,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00063","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}