Two PhD students from Tsinghua University's Department of Computer Science and Technology, High Performance Computing Institute, have been honored with the Distinguished Paper Award at the 33rd Network and Distributed System Security Symposium (NDSS). Rong Kaiyuan and Fang Junqi's paper, titled "OCCUPY+PROBE: Cross-Privilege Branch Target Buffer Side-Channel Attacks at Instruction Granularity," stood out among the conference's rigorous selections, highlighting a significant advancement in cybersecurity research. The work was supervised by Professor Dongsheng Wang.
The Distinguished Paper Award certificate presented at NDSS Symposium 2026
The award-winning work delves into the vulnerabilities of Intel Core processors from the 9th to 14th generations, specifically targeting the Branch Target Buffer (BTB). Through meticulous reverse engineering, the researchers uncovered security flaws in the BTB's update mechanisms. They introduced a novel side-channel attack named Occupy+Probe, which enables user-space detection of whether kernel branch instructions are taken or not, potentially leaking sensitive data. Unlike existing BTB side-channel attacks, Occupy+Probe can bypass hardware isolation mechanisms deployed in Intel’s 11th–14th generation Core processors. It also achieves the highest spatial resolution to date, allowing attacks at an instruction-level granularity. By integrating this side-channel with unprivileged interrupt control techniques, the team successfully extracted an RSA private key from the Linux Kernel Crypto API, achieving a remarkable 98% recovery accuracy. Furthermore, the attack proved effective in breaching Kernel Address Space Layout Randomization (KASLR) on 11th-generation Core processors, demonstrating its real-world threat potential.
Held from February 23 to 27 in San Diego, California, NDSS is one of the top four conferences in the field of network and system security. Recommended as an A-class conference by the China Computer Federation (CCF), this year's edition marked its 33rd installment with an acceptance rate of 17.89%.
Editor: Li Han
