Eviction Notice: Reviving and Advancing Page Cache Attacks

Eviction Notice: Reviving and Advancing Page Cache Attacks

Speakers: Sudheendra Raghav Neela

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=P4auifcqCJI

Overview

Page cache side-channel attacks on Linux were considered mitigated since 2019 and impractical since 2023. This talk revives them and makes them six orders of magnitude faster than prior work. Researcher Sudheendra Raghav Neela from TU Graz systematically identifies four attack primitives -- reload, monitor, flush, and evict -- and combines them into five powerful attack techniques that remain fully functional on modern Linux kernels. The most significant discovery is a deterministic, unprivileged method to flush pages from cache using the fadvise syscall with the POSIX_FADV_DONTNEED flag, which transforms page cache attacks from slow, noisy eviction-based approaches into precise, microsecond-resolution operations.

The researchers demonstrate practical attacks including inter-keystroke timing with 96.7% F1 score, authentication UI redress detection in 800 nanoseconds, cross-Docker-container shared library monitoring, and website fingerprinting on Firefox with 90% F1 score. Despite responsible disclosure leading to the mitigation of the newly discovered cachestat syscall (CVE assigned), all five attack techniques remain viable on current Linux kernels. Linus Torvalds personally mitigated cachestat within hours of the report but was "very rightfully very hesitant" to mitigate the fadvise flush mechanism due to 20+ years of legitimate use.

Background

▶ Watch: Page cache basics and 54-481x speed-up from caching (0:00)

The Linux page cache stores frequently accessed file pages in RAM for faster access, providing speed improvements of 54x on DDR5 systems with fast SSDs and up to 481x on DDR4 with slower SSDs. This caching behavior creates a side channel: if a page is in cache, it was recently accessed, which leaks information about what programs are executing and what files are being read.

The foundational work on page cache attacks was published by Gruss et al. at CCS 2019, demonstrating that the presence or absence of file pages in cache reveals metadata about system activity. If a binary's pages are in cache, the binary was likely executed. If specific pages of a shared library are cached, those code paths were exercised. These attacks operate in a local cross-user threat model where a compromised system service or another user on the same machine infers information about a victim's activity.

The 2019 attacks relied primarily on the mincore syscall to monitor page cache state. Linux kernel developers mitigated mincore immediately upon disclosure by adding access control checks. In 2022-2023, Schwarz et al. demonstrated using perf_event_open v2 with the NO_WAIT flag as an alternative monitoring mechanism, but achieved poor temporal resolution (order of 2 seconds) and the attacks were not taken seriously. Page cache attacks were effectively considered dead.

Key Findings

▶ Watch: Two novel read-ahead bypass methods including backwards reading (4:00)

The researchers classify page cache interactions into four primitives, applying terminology from CPU cache side-channel research to the page cache context for the first time:

Reload (11 syscalls identified): Reading a page reveals whether it was in cache based on timing differences (5x to 147x slower from disk versus cache). A trivial threshold of 22 microseconds on the read syscall distinguishes cached from uncached pages. The researchers discovered that reading backwards completely bypasses the Linux read-ahead mechanism, which normally pulls in up to 32 consecutive pages and contaminates monitoring. The readahead and posix_fadvise(WILLNEED) syscalls also provide timing differences without triggering read-ahead.

Monitor (3 syscalls): Direct reporting of page cache presence without timing and without bringing uncached pages into cache. mincore (mitigated 2019), perf_event_open v2 + NO_WAIT (still unmitigated), and the newly discovered cachestat (introduced 2023, mitigated 2025 after this disclosure). cachestat was blazing fast -- sub-microsecond, under 3,000 cycles -- essentially mincore but much faster.

Flush (most significant discovery): A deterministic, unprivileged method to remove specific pages from cache using fadvise(POSIX_FADV_DONTNEED). This enables precise cache manipulation without noisy memory pressure. Critically, mapping pages prevents flushing -- prior work used mmap and madvise which inadvertently blocked this capability. The flush operation also has a timing side channel: flushing a cached page takes different time than flushing an uncached page, enabling flush-and-flush attacks.

Evict: Memory pressure-based page removal using three eviction sets (useful pages, random uncached pages, baseline mlock pressure) plus a fourth dynamic pressure set. Eviction is slow (0.02+ seconds) and non-deterministic compared to flush.

Technical Deep Dive

▶ Watch: Flush primitive via fadvise DONTNEED -- the biggest discovery (8:00)

The five attack techniques combine these primitives:

Flush and Monitor: Flush a target page, then monitor when it returns to cache. This is the fastest and most powerful technique. When a victim accesses a file, the flushed page reappears in cache and the monitor primitive detects it without bringing other pages into cache.

Flush and Reload: Same principle, but reload (with timing) replaces monitor. Slightly noisier because reload brings the page back into cache.

Flush and Flush: The timing difference of the flush operation itself leaks cache presence. Known in CPU cache research (Gruss et al.), now applied to page cache.

Evict and Monitor: What prior work predominantly used. Slower and noisier due to memory pressure, but still functional.

Evict and Reload: The least reliable combination because eviction pushes pages out while reload pulls them in, causing kernel instability. This combination crashed the system during testing.

The read-ahead bypass is technically elegant: the kernel's read-ahead mechanism only operates in the forward direction. Simply reading pages backwards eliminates read-ahead contamination entirely, providing page-precise information. The researchers describe having "a big facepalm moment" when they realized this.

For website fingerprinting, the researchers monitored libxul (Firefox's core library, 41,000+ pages) using flush-based techniques, observing which library pages entered and left cache during page loads. A random forest classifier on top-100 closed-world evaluation achieved 90% F1 score with flush-and-monitor, and even evict-and-monitor reached nearly 80%.

Demo / Proof of Concept

▶ Watch: Five attack techniques and covert channel benchmarks (10:00)

Four concrete attacks were demonstrated:

Inter-keystroke timing on gedit: An evict-and-monitor attack loop detects when page 32 of gedit comes into cache upon each keystroke. At 5.5 keys per second typing speed, the attack achieves 96.7% F1 score for detecting individual keystrokes.

Authentication UI redress: Flush-and-monitor detects when pkexec (PolicyKit authentication prompt) is launched by monitoring its first page. Detection latency: 800 nanoseconds -- fast enough to overlay a fake password prompt over the real one before the user can react.

Cross-container shared library monitoring: Flush-and-reload detects when shared pages are accessed across Docker containers using the same base image via OverlayFS. The attack detects shell launches in a collocated container by monitoring libreadline.

Website fingerprinting on Firefox: Monitoring libxul page cache patterns across top-100 websites with 90% classification accuracy.

The complete attack toolkit is available on GitHub as a fully reproducible artifact that works on most Linux distributions.

Defensive Implications

▶ Watch: Responsible disclosure: all five attack techniques still work (14:00)

The responsible disclosure results paint a concerning picture. Mitigating cachestat (applying the same access control fix used for mincore) addresses only a small portion of the attack surface. The fadvise(POSIX_FADV_DONTNEED) flush mechanism has been in the kernel for over 20 years, and legitimate programs depend on it. Linus Torvalds was understandably reluctant to break existing software by restricting it.

All five attack techniques remain viable on current Linux kernels. The perf_event_open v2 + NO_WAIT monitor mechanism is still unmitigated. The flush primitive via fadvise remains unrestricted. And the fundamental reload timing side channel cannot be eliminated without changing how the page cache works.

For defenders, the practical implications include:

• Container isolation does not prevent page cache attacks when containers share base images via OverlayFS
• Keystroke timing attacks are practical at sub-millisecond resolution
• Authentication prompt detection at nanosecond speed enables UI redress attacks
• No kernel-level fix is forthcoming for the core flush primitive due to backward compatibility requirements

Organizations relying on Linux user-level isolation for security boundaries should consider these attacks as part of their threat model, particularly in multi-tenant environments and container orchestration platforms.

Key Takeaways

• Page cache attacks, considered mitigated/impractical since 2019, are revived and six orders of magnitude faster than prior work
• The fadvise(POSIX_FADV_DONTNEED) flush primitive is the key enabler: deterministic, unprivileged page cache eviction that has existed in the kernel for 20+ years
• Reading backwards completely bypasses Linux's read-ahead mechanism -- a remarkably simple technique
• Five attack techniques remain fully viable: flush+monitor, flush+reload, flush+flush, evict+monitor, evict+reload
• cachestat was mitigated (CVE assigned, Torvalds patched in hours) but it was only one small piece of the attack surface
• Practical attacks achieve 96.7% keystroke detection, 800ns auth prompt detection, 90% website fingerprinting, and cross-container monitoring
• Complete reproducible artifact available on GitHub

About the Speaker(s)

Sudheendra Raghav Neela is a PhD student at TU Graz in Austria, advised by Daniel Gruss -- the same researcher who led the original 2019 page cache attacks work and is known for foundational CPU cache side-channel research including Flush+Flush. The research team has a strong track record in microarchitectural and OS-level side-channel attacks, and maintains an active responsible disclosure practice with Linux kernel developers.