{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T15:54:44Z","timestamp":1783007684651,"version":"3.54.5"},"publisher-location":"New York, NY, USA","reference-count":61,"publisher":"ACM","funder":[{"name":"European Union","award":["101141972"],"award-info":[{"award-number":["101141972"]}]},{"name":"Horizon Europe","award":["101120962"],"award-info":[{"award-number":["101120962"]}]},{"name":"NWO","award":["024.006.037"],"award-info":[{"award-number":["024.006.037"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3765126","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:33:16Z","timestamp":1763854396000},"page":"4499-4513","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Dynamic Detection of Vulnerable DMA Race Conditions"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-6882-3024","authenticated-orcid":false,"given":"Brian","family":"Johannesmeyer","sequence":"first","affiliation":[{"name":"Qualcomm Technologies, Inc., San Diego, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-6224-9795","authenticated-orcid":false,"given":"Raphael","family":"Isemann","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam, Amsterdam, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8329-5929","authenticated-orcid":false,"given":"Cristiano","family":"Giuffrida","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam, Amsterdam, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6179-1510","authenticated-orcid":false,"given":"Herbert","family":"Bos","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam, Amsterdam, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2015. syzkaller. https:\/\/github.com\/google\/syzkaller."},{"key":"e_1_3_2_1_2_1","unstructured":"2016. CVE-2016--5195. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016--5195."},{"key":"e_1_3_2_1_3_1","unstructured":"2019. Clang 19.1.0 documentation - AddressSanitizer. https:\/\/releases.llvm.org\/19.1.0\/tools\/clang\/docs\/AddressSanitizer.html."},{"key":"e_1_3_2_1_4_1","unstructured":"2019. Clang 19.1.0 documentation - MemorySanitizer. https:\/\/releases.llvm.org\/19.1.0\/tools\/clang\/docs\/MemorySanitizer.html#origin-tracking."},{"key":"e_1_3_2_1_5_1","unstructured":"2019. Clang 19.1.0 documentation - ThreadSanitizer. https:\/\/releases.llvm.org\/19.1.0\/tools\/clang\/docs\/ThreadSanitizer.html."},{"key":"e_1_3_2_1_6_1","unstructured":"2020. KCSAN: Kernel Concurrency Sanitizer. https:\/\/www.kernel.org\/doc\/html\/latest\/dev-tools\/kcsan.html."},{"key":"e_1_3_2_1_7_1","unstructured":"Advanced Micro Devices Inc. 2007. IOMMU Architectural Specification."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"crossref","unstructured":"Markuze Alex Shay Vargaftik Gil Kupfer Boris Pismeny Nadav Amit Adam Morrison and Dan Tsafrir. 2021. Characterizing Exploiting and Detecting DMA Code Injection Vulnerabilities in the Presence of an IOMMU. EuroSys (2021).","DOI":"10.1145\/3447786.3456249"},{"key":"e_1_3_2_1_9_1","volume-title":"Once upon a free(). Phrack","author":"Anonymous","year":"2001","unstructured":"Anonymous. 2001. Once upon a free(). Phrack (2001)."},{"key":"e_1_3_2_1_10_1","volume-title":"Static Detection of Unsafe DMA Accesses in Device Drivers. USENIX Security","author":"Bai Jia-Ju","year":"2021","unstructured":"Jia-Ju Bai, Tuo Li, Kangjie Lu, and Shi-Min Hu. 2021. Static Detection of Unsafe DMA Accesses in Device Drivers. USENIX Security (2021)."},{"key":"e_1_3_2_1_11_1","volume-title":"Midas: Systematic Kernel TOCTTOU Protection. USENIX Security","author":"Bhattacharyya Atri","year":"2022","unstructured":"Atri Bhattacharyya, Uros Tesic, and Mathias Payer. 2022. Midas: Systematic Kernel TOCTTOU Protection. USENIX Security (2022)."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.23"},{"key":"e_1_3_2_1_13_1","volume-title":"Linux Device Drivers","author":"Corbet Jonathan","unstructured":"Jonathan Corbet, Alessandro Rubini, and Greg Kroah-Hartman. 2005. Linux Device Drivers. O'Reilly Media, Inc."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134069"},{"key":"e_1_3_2_1_15_1","volume-title":"Mitchel Josephus Aloserij, and Cristiano Giuffrida","author":"Duta Victor","year":"2024","unstructured":"Victor Duta, Mitchel Josephus Aloserij, and Cristiano Giuffrida. 2024. SafeFetch: Practical Double-Fetch Protection with Kernel-Fetch Caching. USENIX Security (2024)."},{"key":"e_1_3_2_1_16_1","volume-title":"Static Detection of Race Conditions and Deadlocks. SOSP","author":"Engler Dawson","year":"2003","unstructured":"Dawson Engler and Ken Ashcraft. 2003. RacerX: Effective, Static Detection of Race Conditions and Deadlocks. SOSP (2003)."},{"key":"e_1_3_2_1_17_1","volume-title":"Effective Data-Race Detection for the Kernel. OSDI","author":"Erickson John","year":"2010","unstructured":"John Erickson, Madanlal Musuvathi, Sebastian Burckhardt, and Kirk Olynyk. 2010. Effective Data-Race Detection for the Kernel. OSDI (2010)."},{"key":"e_1_3_2_1_18_1","volume-title":"P2IM: Scalable and Hardwareindependent Firmware Testing via Automatic Peripheral Interface Modeling. USENIX Security","author":"Feng Bo","year":"2020","unstructured":"Bo Feng, Alejandro Mera, and Long Lu. 2020. P2IM: Scalable and Hardwareindependent Firmware Testing via Automatic Peripheral Interface Modeling. USENIX Security (2020)."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1542476.1542490"},{"key":"e_1_3_2_1_20_1","volume-title":"ReUSB: Replay-Guided USB Driver Fuzzing. USENIX Security","author":"Jang Jisoo","year":"2023","unstructured":"Jisoo Jang, Minsuk Kang, and Dokyung Song. 2023. ReUSB: Replay-Guided USB Driver Fuzzing. USENIX Security (2023)."},{"key":"e_1_3_2_1_21_1","volume-title":"Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel. NDSS","author":"Johannesmeyer Brian","year":"2022","unstructured":"Brian Johannesmeyer, Jakob Koschel, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida. 2022. Kasper: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel. NDSS (2022)."},{"key":"e_1_3_2_1_22_1","unstructured":"Mateusz Jurczyk and Gynvael Coldwind. 2013. Identifying and Exploiting Windows Kernel Race Conditions via Memory Access Patterns. (2013)."},{"key":"e_1_3_2_1_23_1","volume-title":"Vudo malloc tricks. Phrack","author":"Kaempf Michel","year":"2001","unstructured":"Michel Kaempf. 2001. Vudo malloc tricks. Phrack (2001)."},{"key":"e_1_3_2_1_24_1","volume-title":"DTA: Dynamic Taint Analysis with Targeted Control-Flow Propagation. NDSS","author":"Kang Min Gyung","year":"2011","unstructured":"Min Gyung Kang, Stephen McCamant, Pongsin Poosankam, and Dawn Song. 2011. DTA: Dynamic Taint Analysis with Targeted Control-Flow Propagation. NDSS (2011)."},{"key":"e_1_3_2_1_25_1","volume-title":"Antonio Bianchi, and Dave Jing Tian.","author":"Kim Kyungtae","year":"2022","unstructured":"Kyungtae Kim, Taegyu Kim, Ertza Warraich, Byoungyoung Lee, Kevin RB Butler, Antonio Bianchi, and Dave Jing Tian. 2022. FuzzUSB: Hybrid Stateful Fuzzing of USB Gadget Stacks. S&P (2022)."},{"key":"e_1_3_2_1_26_1","volume-title":"Detecting race conditions in asynchronous DMA operations with full system simulation. ISPASS","author":"Kistler Michael","year":"2011","unstructured":"Michael Kistler and Daniel Brokenshire. 2011. Detecting race conditions in asynchronous DMA operations with full system simulation. ISPASS (2011)."},{"key":"e_1_3_2_1_27_1","unstructured":"Damien Le Moal. 2017. I\/O Latency Optimization with Polling. Vault (2017)."},{"key":"e_1_3_2_1_28_1","volume-title":"Untrusted Hardware Causes Double-Fetch Problems in the I\/O Memory. JCST","author":"Lu Kai","year":"2018","unstructured":"Kai Lu, Peng-Fei Wang, Gen Li, and Xu Zhou. 2018. Untrusted Hardware Causes Double-Fetch Problems in the I\/O Memory. JCST (2018)."},{"key":"e_1_3_2_1_29_1","volume-title":"DFTinker: Detecting and Fixing Double-fetch Bugs in an Automated Way. WASA","author":"Luo Yingqi","year":"2018","unstructured":"Yingqi Luo, Pengfei Wang, Xu Zhou, and Kai Lu. 2018. DFTinker: Detecting and Fixing Double-fetch Bugs in an Automated Way. WASA (2018)."},{"key":"e_1_3_2_1_30_1","volume-title":"PrIntFuzz: Fuzzing Linux Drivers via Automated Virtual Device Simulation. ISSTA","author":"Ma Zheyu","year":"2022","unstructured":"Zheyu Ma, Bodong Zhao, Letu Ren, Zheming Li, Siqi Ma, Xiapu Luo, and Chao Zhang. 2022. PrIntFuzz: Fuzzing Linux Drivers via Automated Virtual Device Simulation. ISSTA (2022)."},{"key":"e_1_3_2_1_31_1","volume-title":"Thunderclap: Exploring Vulnerabilities in Operating System IOMMU Protection via DMA from Untrustworthy Peripherals. NDSS","author":"Markettos A Theodore","year":"2019","unstructured":"A Theodore Markettos, Colin Rothwell, Brett F Gutstein, Allison Pearce, Peter G Neumann, Simon W Moore, and Robert NM Watson. 2019. Thunderclap: Exploring Vulnerabilities in Operating System IOMMU Protection via DMA from Untrustworthy Peripherals. NDSS (2019)."},{"key":"e_1_3_2_1_32_1","volume-title":"lmbench: Portable Tools for Performance Analysis. ATC","author":"McVoy Larry","year":"1996","unstructured":"Larry McVoy and Carl Staelin. 1996. lmbench: Portable Tools for Performance Analysis. ATC (1996)."},{"key":"e_1_3_2_1_33_1","volume-title":"DICE: Automatic Emulation of DMA Input Channels for Dynamic Firmware Analysis. S&P","author":"Mera Alejandro","year":"2021","unstructured":"Alejandro Mera, Bo Feng, Long Lu, and Engin Kirda. 2021. DICE: Automatic Emulation of DMA Input Channels for Dynamic Firmware Analysis. S&P (2021)."},{"key":"e_1_3_2_1_34_1","volume-title":"What Are Race Conditions? Some Issues and Formalizations. LOPLAS","author":"Netzer Robert HB","year":"1992","unstructured":"Robert HB Netzer and Barton P Miller. 1992. What Are Race Conditions? Some Issues and Formalizations. LOPLAS (1992)."},{"key":"e_1_3_2_1_35_1","volume-title":"Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software. NDSS","author":"Newsome James","year":"2005","unstructured":"James Newsome and Dawn Xiaodong Song. 2005. Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software. NDSS (2005)."},{"key":"e_1_3_2_1_36_1","volume-title":"The Multics System: An Examination of its Structure","author":"Organick Elliott I","unstructured":"Elliott I Organick. 1972. The Multics System: An Examination of its Structure. MIT Press."},{"key":"e_1_3_2_1_37_1","volume-title":"USBFuzz: A Framework for Fuzzing USB Drivers by Device Emulation. USENIX Security","author":"Peng Hui","year":"2020","unstructured":"Hui Peng and Mathias Payer. 2020. USBFuzz: A Framework for Fuzzing USB Drivers by Device Emulation. USENIX Security (2020)."},{"key":"e_1_3_2_1_38_1","unstructured":"Alexander Potapenko. 2022. Kernel Memory Sanitizer (KMSAN). https:\/\/docs.kernel.org\/dev-tools\/kmsan.html."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/1133981.1134019"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00094"},{"key":"e_1_3_2_1_41_1","volume-title":"Defense and Attack Techniques Against File-Based TOCTOU Vulnerabilities: A Systematic Review","author":"Raducu Razvan","year":"2022","unstructured":"Razvan Raducu, Ricardo J Rodr\u00edguez, and Pedro \u00c1lvarez. 2022. Defense and Attack Techniques Against File-Based TOCTOU Vulnerabilities: A Systematic Review. IEEE Access (2022)."},{"key":"e_1_3_2_1_42_1","volume-title":"Dynamic Detection and Mitigation of DMA Races in MPSoCs. DSD","author":"Saidi Selma","year":"2015","unstructured":"Selma Saidi and Ylies Falcone. 2015. Dynamic Detection and Mitigation of DMA Races in MPSoCs. DSD (2015)."},{"key":"e_1_3_2_1_43_1","volume-title":"Protection and the Control of Information Sharing in Multics. CACM","author":"Saltzer Jerome H","year":"1974","unstructured":"Jerome H Saltzer. 1974. Protection and the Control of Information Sharing in Multics. CACM (1974)."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/268998.266641"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.26"},{"key":"e_1_3_2_1_46_1","volume-title":"Automated Detection, Exploitation, and Elimination of Double-Fetch Bugs using Modern CPU Features. AsiaCCS","author":"Schwarz Michael","year":"2018","unstructured":"Michael Schwarz, Daniel Gruss, Moritz Lipp, Cl\u00e9mentine Maurice, Thomas Schuster, Anders Fogh, and Stefan Mangard. 2018. Automated Detection, Exploitation, and Elimination of Double-Fetch Bugs using Modern CPU Features. AsiaCCS (2018)."},{"key":"e_1_3_2_1_47_1","volume-title":"AddressSanitizer: A Fast Address Sanity Checker. ATC","author":"Serebryany Konstantin","year":"2012","unstructured":"Konstantin Serebryany, Derek Bruening, Alexander Potapenko, and Dmitriy Vyukov. 2012. AddressSanitizer: A Fast Address Sanity Checker. ATC (2012)."},{"key":"e_1_3_2_1_48_1","volume-title":"Dynamic Race Detection with LLVM Compiler: Compile-time instrumentation for ThreadSanitizer. RV","author":"Serebryany Konstantin","year":"2011","unstructured":"Konstantin Serebryany, Alexander Potapenko, Timur Iskhodzhanov, and Dmitriy Vyukov. 2011. Dynamic Race Detection with LLVM Compiler: Compile-time instrumentation for ThreadSanitizer. RV (2011)."},{"key":"e_1_3_2_1_49_1","volume-title":"Drifuzz: Harvesting Bugs in Device Drivers from Golden Seeds. USENIX Security","author":"Shen Zekun","year":"2022","unstructured":"Zekun Shen, Ritik Roongta, and Brendan Dolan-Gavitt. 2022. Drifuzz: Harvesting Bugs in Device Drivers from Golden Seeds. USENIX Security (2022)."},{"key":"e_1_3_2_1_50_1","volume-title":"PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary. NDSS","author":"Song Dokyung","year":"2019","unstructured":"Dokyung Song, Felicitas Hetzelt, Dipanjan Das, Chad Spensky, Yeoul Na, Stijn Volckaert, Giovanni Vigna, Christopher Kruegel, Jean-Pierre Seifert, and Michael Franz. 2019. PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary. NDSS (2019)."},{"key":"e_1_3_2_1_51_1","volume-title":"MemorySanitizer: fast detector of uninitialized memory use in C. CGO","author":"Stepanov Evgeniy","year":"2015","unstructured":"Evgeniy Stepanov and Konstantin Serebryany. 2015. MemorySanitizer: fast detector of uninitialized memory use in C. CGO (2015)."},{"key":"e_1_3_2_1_52_1","volume-title":"Ardalan Amiri Sani, and Zhiyun Qian","author":"Seyed Talebi Seyed Mohammadjavad","year":"2018","unstructured":"Seyed Mohammadjavad Seyed Talebi, Hamid Tavakoli, Hang Zhang, Zheng Zhang, Ardalan Amiri Sani, and Zhiyun Qian. 2018. Charm: Facilitating Dynamic Analysis of Device Drivers of Mobile Systems. USENIX Security (2018)."},{"key":"e_1_3_2_1_53_1","volume-title":"How Double-Fetch Situations turn into Double-Fetch Vulnerabilities: A Study of Double Fetches in the Linux Kernel. USENIX Security","author":"Wang Pengfei","year":"2017","unstructured":"Pengfei Wang, Jens Krinke, Kai Lu, Gen Li, and Steve Dodier-Lazaro. 2017. How Double-Fetch Situations turn into Double-Fetch Vulnerabilities: A Study of Double Fetches in the Linux Kernel. USENIX Security (2017)."},{"key":"e_1_3_2_1_54_1","volume-title":"DFTracker: Detecting Doublefetch Bugs by Multi-taint Parallel Tracking. FCS","author":"Wang Pengfei","year":"2019","unstructured":"Pengfei Wang, Kai Lu, Gen Li, and Xu Zhou. 2019. DFTracker: Detecting Doublefetch Bugs by Multi-taint Parallel Tracking. FCS (2019)."},{"key":"e_1_3_2_1_55_1","volume-title":"Exploiting Concurrency Vulnerabilities in System Call Wrappers. WOOT","author":"Watson Robert NM","year":"2007","unstructured":"Robert NM Watson. 2007. Exploiting Concurrency Vulnerabilities in System Call Wrappers. WOOT (2007)."},{"key":"e_1_3_2_1_56_1","volume-title":"Async-Shock: Exploiting Synchronisation Bugs in Intel SGX Enclaves. ESORICS","author":"Weichbrodt Nico","year":"2016","unstructured":"Nico Weichbrodt, Anil Kurmus, Peter Pietzuch, and R\u00fcdiger Kapitza. 2016. Async-Shock: Exploiting Synchronisation Bugs in Intel SGX Enclaves. ESORICS (2016)."},{"key":"e_1_3_2_1_57_1","volume-title":"DevFuzz: Automatic Device Model-Guided Device Driver Fuzzing. S&P","author":"Wu Yilun","year":"2023","unstructured":"Yilun Wu, Tong Zhang, Changhee Jung, and Dongyoon Lee. 2023. DevFuzz: Automatic Device Model-Guided Device Driver Fuzzing. S&P (2023)."},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00017"},{"key":"e_1_3_2_1_59_1","volume-title":"Saturn: Host-Gadget Synergistic USB Driver Fuzzing. S&P","author":"Xu Yiru","year":"2024","unstructured":"Yiru Xu, Hao Sun, Jianzhong Liu, Yuheng Shen, and Yu Jiang. 2024. Saturn: Host-Gadget Synergistic USB Driver Fuzzing. S&P (2024)."},{"key":"e_1_3_2_1_60_1","volume-title":"Bit-Level Taint Analysis. SCAM","author":"Yadegari Babak","year":"2014","unstructured":"Babak Yadegari and Saumya Debray. 2014. Bit-Level Taint Analysis. SCAM (2014)."},{"key":"e_1_3_2_1_61_1","volume-title":"Semantic-Informed Driver Fuzzing Without Both the Hardware Devices and the Emulators. NDSS","author":"Zhao Wenjia","year":"2022","unstructured":"Wenjia Zhao, Kangjie Lu, Qiushi Wu, and Yong Qi. 2022. Semantic-Informed Driver Fuzzing Without Both the Hardware Devices and the Emulators. NDSS (2022)."}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","location":"Taipei Taiwan","acronym":"CCS '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765126","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:20:37Z","timestamp":1766442037000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3765126"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":61,"alternative-id":["10.1145\/3719027.3765126","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3765126","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}