Assistant Professor Flavien Solt Receives Distinguished Paper Award at IEEE Symposium on Security and Privacy 2026

Assistant Professor Flavien Solt and collaborators at Microsoft Research has received a Distinguished Paper award at the 2026 IEEE Symposium on Security and Privacy, one of the field's most selective venues.

The paper, "Enter, Exit, Page Fault, Leak: Testing Isolation Boundaries for Microarchitectural Leaks", examines a basic promise of cloud computing: unrelated customers may share a physical server without gaining access to each other's data. Virtualisation is designed to keep their workloads separate. Yet features that make modern processors faster, including branch predictors, can leave traces of activity across this boundary. An attacker may exploit those traces to infer protected data, a threat security researchers have studied for years.

Researchers have traditionally looked for such weaknesses by hand-crafting test cases based on where they suspected a processor might fail. Led by co-first authors Oleksii Oleksenko and Flavien Solt, the team developed a more systematic approach. Their fuzzer generates short, randomised programs that exercise isolation boundaries, including those between a virtual machine and its host or between the kernel and a user-level process.

Tests on six x86 processors reproduced known leaks and showed that existing mitigations worked. They also revealed four previously undocumented vulnerabilities. One of the most serious, found on AMD Zen 4 processors, could expose another virtual machine's memory one bit at a time. Another could allow a user-level program to recover data recently written by the kernel. AMD confirmed both findings. The researchers kept them under embargo for roughly a year while mitigations were developed. This category of vulnerability is now known as Transient Scheduler Attacks.

The results matter beyond the four vulnerabilities. Cloud platforms routinely place customers who do not trust one another on shared hardware, making strong isolation essential. The fuzzer gives processor vendors a repeatable way to search for this class of flaw before an attacker does.

"The bugs matter, but the method is the real contribution. Testing for this class of leak has depended on intuition for years. Giving vendors a systematic way to find them is a forward-facing contribution of this work."

The work builds on Revizor, an earlier fuzzer created by members of the team, as well as broader research into the security guarantees that hardware must provide to software.

The team also introduces several avenues for future work. Generated programs follow a fixed structure, which may exclude some leak patterns. The fuzzer treats the processor as a black box, leaving it unable to observe what happens inside the chip during a test. Future versions could add this visibility and extend the technique to additional isolation boundaries.