{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,2]],"date-time":"2026-10-02T17:11:28Z","timestamp":1790961088024,"version":"4.1.0"},"reference-count":57,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"7","license":[{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,7,1]],"date-time":"2025-07-01T00:00:00Z","timestamp":1751328000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2022YFB4500402"],"award-info":[{"award-number":["2022YFB4500402"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst."],"published-print":{"date-parts":[[2025,7]]},"DOI":"10.1109\/tcad.2025.3527903","type":"journal-article","created":{"date-parts":[[2025,1,9]],"date-time":"2025-01-09T19:50:15Z","timestamp":1736452215000},"page":"2461-2474","source":"Crossref","is-referenced-by-count":1,"title":["Oxpecker: Leaking Secrets via Fetch Target Queue"],"prefix":"10.1109","volume":"44","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5961-3969","authenticated-orcid":false,"given":"Shan","family":"Li","sequence":"first","affiliation":[{"name":"School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-3013-197X","authenticated-orcid":false,"given":"Zheliang","family":"Xu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5061-257X","authenticated-orcid":false,"given":"Haihua","family":"Shen","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8082-4218","authenticated-orcid":false,"given":"Huawei","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-79263-5_16"},{"key":"ref2","first-page":"719","article-title":"FLUSH+RELOAD: A high resolution, low noise, L3 cache side-channel attack","volume-title":"Proc. 23rd USENIX Security Symp. (USENIX Security)","author":"Yarom"},{"key":"ref3","first-page":"1967","article-title":"RELOAD+REFRESH: Abusing cache replacement policies to perform stealthy cache attacks","volume-title":"Proc. 29th USENIX Security Symp. (USENIX Security)","author":"Briongos"},{"key":"ref4","first-page":"549","article-title":"ARMageddon: Cache attacks on mobile devices","volume-title":"Proc. 25th USENIX Security Symp. (USENIX Security)","author":"Lipp"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/11605805_1"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_14"},{"key":"ref7","first-page":"51","article-title":"Prime+abort: A timer-free high-precision L3 cache attack using intel TSX","volume-title":"Proc. 26th USENIX Security Symp. (USENIX Security)","author":"Disselkoen"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD50377.2020.00095"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA47549.2020.00021"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA53966.2022.00015"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA53966.2022.00013"},{"key":"ref12","first-page":"643","article-title":"AMD prefetch attacks through power and time","volume-title":"Proc. 31st USENIX Security Symp. (USENIX Security)","author":"Lipp"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3399742"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3357033"},{"key":"ref15","first-page":"1","article-title":"Spectre returns! Speculation attacks using the return stack buffer","volume-title":"Proc. 12th USENIX Workshop Offensive Technol. (WOOT)","author":"Koruyeh"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29959-0_14"},{"key":"ref17","article-title":"MeltdownPrime and spectreprime: Automatically-synthesized attacks exploiting invalidation-based coherence protocols","author":"Trippel","year":"2018","journal-title":"arXiv:1802.03802"},{"key":"ref18","first-page":"971","article-title":"Branch history injection: On the effectiveness of hardware mitigations against cross-privilege spectre-v2 attacks","volume-title":"Proc. 31st USENIX Security Symp. (USENIX Security)","author":"Barberis"},{"key":"ref19","first-page":"3825","article-title":"RETBLEED: Arbitrary speculative code execution with return instructions","volume-title":"Proc. 31st USENIX Security Symp. (USENIX Security)","author":"Wikner"},{"key":"ref20","article-title":"LazyFP: Leaking FPU register state using microarchitectural side-channels","author":"Stecklina","year":"2018","journal-title":"arXiv:1806.07480"},{"key":"ref21","article-title":"Store-to-leak forwarding: Leaking data on meltdown-resistant CPUs (updated and extended version)","author":"Schwarz","year":"2019","journal-title":"arXiv:1905.05725"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363219"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00087"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354252"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3384746"},{"key":"ref26","first-page":"1427","article-title":"Medusa: Microarchitectural data leakage via automated attack synthesis","volume-title":"Proc. 29th USENIX Security Symp. (USENIX Security)","author":"Moghimi"},{"key":"ref27","article-title":"SPEECHMINER: A framework for investigating and measuring speculative execution vulnerabilities","author":"Xiao","year":"2019","journal-title":"arXiv:1912.00329"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/s13389-016-0141-6"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/s41635-018-0046-1"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/isca52012.2021.00036"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3579371.3589100"},{"key":"ref32","first-page":"7321","article-title":"BunnyHop: Exploiting the instruction prefetcher","volume-title":"Proc. 32nd USENIX Security Symp. (USENIX Security)","author":"Zhang"},{"key":"ref33","first-page":"49","article-title":"Phantom: Exploiting decoder-detectable mispredictions","volume-title":"Proc. 56th Annu. IEEE\/ACM Int. Symp. Microarchit.","author":"Wikner"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.46586\/tches.v2020.i1.321-347"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3296957.3173204"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA.1999.765954"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3296957.3173178"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2017.53"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA45697.2020.00015"},{"key":"ref40","volume-title":"Arm\u2019s cortex-A76 CPU unveiled: Taking aim at the top for 7nm.","author":"Frumusanu","year":"2018"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1117\/12.2642006"},{"key":"ref42","volume-title":"The Fetch Target Queue","year":"2019"},{"key":"ref43","volume-title":"Kernel address space layout randomization.","author":"Edge","year":"2013"},{"key":"ref44","volume-title":"Computer Architecture: A Quantitative Approach","author":"Hennessy","year":"2011"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.1999.809439"},{"key":"ref46","volume-title":"Apparatuses and methods for a processor architectures","author":"Lai","year":"2014"},{"key":"ref47","volume-title":"Retpoline: A Branch Target Injection Mitigation","year":"2018"},{"key":"ref48","volume-title":"Indirect Branch Restricted Speculation","year":"2018"},{"key":"ref49","volume-title":"Intel\u00ae 64 and ia-32 Architectures Software Developer\u2019s Manual Combined Volumes: 1, 2A, 2B, 2C, 2D, 3A, 3B, 3C, 3D, and 4","year":"2023"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/LPE.2001.945363"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3445814.3446742"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2018.00024"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833692"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/MM.2021.3069158"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23271"},{"key":"ref56","first-page":"955","article-title":"Translation leak-aside buffer: Defeating cache side-channel protections with TLB attacks","volume-title":"Proc. 27th USENIX Security Symp. (USENIX Security)","author":"Gras"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2021.3122830"}],"container-title":["IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/43\/11044910\/10835128.pdf?arnumber=10835128","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,20]],"date-time":"2025-06-20T04:49:18Z","timestamp":1750394958000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10835128\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7]]},"references-count":57,"journal-issue":{"issue":"7"},"URL":"https:\/\/doi.org\/10.1109\/tcad.2025.3527903","relation":{},"ISSN":["0278-0070","1937-4151"],"issn-type":[{"value":"0278-0070","type":"print"},{"value":"1937-4151","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7]]}}}