Lukas Gerlach

Lukas Gerlach

PhD Candidate

About

I am a PhD candidate at CISPA Helmholtz Center for Information Security in the research group of Dr. Michael Schwarz, where I started in 2023. My research focuses on microarchitectural security, exploring vulnerabilities in modern and emerging CPU architectures.

I work on automated security analysis techniques to discover and understand processor vulnerabilities, with publications at IEEE S&P, USENIX Security, and other top venues. My research spans RISC-V security, automated reverse-engineering of CPU internals, side-channel attacks on trusted execution environments, and compiler-induced cryptographic vulnerabilities.

Publications

2026

Zero-Store Elimination and its Implications on the SIKE Cryptosystem uASC2026

2025

RISCover: Automatic Discovery of User-exploitable Architectural Security Vulnerabilities in Closed-Source RISC-V CPUs CCS2025
SCASE: Automated Secret Recovery via Side-Channel-Assisted Symbolic Execution USENIX Security2025
Confusing Value with Enumeration: Studying the Use of CVEs in Academia USENIX Security2025
Taming the Linux Memory Allocator for Rapid Prototyping DIMVA2025
Rapid Reversing of Non-Linear CPU Cache Slice Functions: Unlocking Physical Address Leakage S&P2025
Lixom: Protecting Encryption Keys with Execute-Only Memory FC2025
Do Compilers Break Constant-time Guarantees? FC2025
Cascading Spy Sheets: Exploiting the Complexity of Modern CSS for Email and Browser Fingerprinting NDSS2025
ShadowLoad: Injecting State into Hardware Prefetchers ASPLOS2025
Peripheral Instinct: How External Devices Breach Browser Sandboxes WWW2025

2024

No Leakage Without State Change: Repurposing Configurable CPU Exceptions to Prevent Microarchitectural Attacks ACSAC2024
Efficient and Generic Microarchitectural Hash-Function Recovery IEEE S&P2024
CacheWarp: Software-based Fault Injection using Selective State Reset USENIX Security2024

2023

Reviving Meltdown 3a ESORICS2023
Indirect Meltdown: Building Novel Side-Channel Attacks from Transient-Execution Attacks ESORICS2023
A Rowhammer Reproduction Study Using the Blacksmith Fuzzer ESORICS2023
Collide+Power: Leaking Inaccessible Data with Software-based Power Side Channels USENIX Security2023
Hammulator: Simulate Now-Exploit Later DRAMSec2023
A Security RISC: Microarchitectural Attacks on Hardware RISC-V CPUs IEEE S&P2023

Talks

A Security RISC? The State of Microarchitectural Attacks on RISC-V Blackhat EU 2023
Rowhammer Revisited: From Exploration to Exploitation and Mitigation m0leCon 2023 2023