@inproceedings{Garcia2026LeakyTree,
  author = {Ernesto Martinez Garcia and Lukas Maar and Martin Unterguggenberger and Mathias Oberhuber and Stefan Mangard},
  booktitle = {{CCS}},
  title = {{LeakyTree: Cross-VM Bit-by-Bit Deduplicated Page Leakage via Linux Kernel Samepage Merging Internals}},
  year = {2026}
}

@inproceedings{Garcia2026Fence2Pwn,
  author = {Ernesto Martinez Garcia and Lukas Maar and Martin Unterguggenberger and Stefan Mangard},
  booktitle = {{USENIX Security}},
  title = {{Fence2Pwn: KFENCE-Enabled Kernel Exploitation Bypassing Slab Hardening and Memory Tagging}},
  year = {2026}
}

@inproceedings{Draschbacher2026Clone2Pwn,
  author = {Florian Draschbacher and Lukas Maar and Lorenz Schumm and Rene Denifl and Lukas Treffner and Stefan Mangard},
  booktitle = {{ESORICS}},
  title = {{Clone2Pwn: A Systematic Security Analysis of Data Migration Tools in the Android Ecosystem}},
  year = {2026}
}

@inproceedings{Neela2026EvictionNotice,
  author = {Sudheendra Raghav Neela and Jonas Juffinger and Lukas Maar and Daniel Gruss},
  booktitle = {{NDSS}},
  title = {{Eviction Notice: Reviving and Advancing Page Cache Attacks}},
  year = {2026}
}

@phdthesis{Maar2025KernelSecurityInTheWild,
  author = {Lukas Maar},
  title = {{Kernel Security in the Wild}},
  year = {2025},
  school = {Graz University of Technology},
  type = {PhD thesis}
}

In this paper, we examine the security of Android devices against n-day exploitation. First, we identify kernel drivers accessible to untrusted apps, revealing a broader-than-expected kernel attack surface. Using public sources like git history, we then identify n-day vulnerabilities in these drivers. Finally, we perform a patch analysis that shows many remain unpatched for extended periods. This enables malicious actors to exploit n-days instead of relying on costly zero-days.

@inproceedings{Maar2025DeviceDrivers,
  author = {Lukas Maar and Florian Draschbacher and Lorenz Schumm and Ernesto Martinez Garcia and Stefan Mangard},
  booktitle = {{USENIX Security}},
  title = {{The Doom of Device Drivers: Your Android Device (Most Likely) has N-Day Kernel Vulnerabilities}},
  year = {2025}
}

In this paper, we show how side-channel leakage in kernel defenses can expose the locations of security-critical kernel objects, enabling reliable kernel exploitation. We show that fine-graining the object's memory mapping by enabling any of three defenses exposes exploitable TLB contention patterns observable via a side channel. Combined with kernel allocator massaging, this allows location disclosure attacks, revealing the locations of kernel heap objects, page tables and stacks.

@inproceedings{Maar2025LocationDisclosures,
  author = {Lukas Maar and Lukas Giner and Daniel Gruss and Stefan Mangard},
  booktitle = {{USENIX Security}},
  title = {{When Good Kernel Defenses Go Bad: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks}},
  year = {2025}
}

@inproceedings{Draschbacher2025ChoiceJacking,
  author = {Florian Draschbacher and Lukas Maar and Mathias Oberhuber and Stefan Mangard},
  booktitle = {{USENIX Security}},
  title = {{ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago}},
  year = {2025}
}

@inproceedings{Unterguggenberger2025CLPE,
  author = {Martin Unterguggenberger and David Schrammel and Lukas Maar and Lukas Lamster and Vedad Hadzic and Stefan Mangard},
  booktitle = {{HOST}},
  title = {{Cryptographic Least Privilege Enforcement for Scalable Memory Isolation}},
  year = {2025}
}

In this paper, we introduce KernelSnitch, a novel hardware-agnostic side-channel attack that exploits timing variations in kernel data structures like hash tables and trees to leak sensitive information. We demonstrate leakage amplification approaches to make this side channel exploitable from user space. Through a kernel heap pointer leak, covert channel and activity monitoring, we demonstrate practical attacks.

@inproceedings{Maar2025KernelSnitch,
  author = {Lukas Maar and Jonas Juffinger and Thomas Steinbauer and Daniel Gruss and Stefan Mangard},
  booktitle = {{NDSS}},
  title = {{KernelSnitch: Side-Channel Attacks on Kernel Data Structures}},
  year = {2025}
}

@inproceedings{Oberhuber2025PowerAndroidSensor,
  author = {Mathias Oberhuber and Martin Unterguggenberger and Lukas Maar and Andreas Kogler and Stefan Mangard},
  booktitle = {{NDSS}},
  title = {{Power-Related Side-Channel Attacks using the Android Sensor Framework}},
  year = {2025}
}

@inproceedings{Draschbacher2024ManifestProblems,
  author = {Florian Draschbacher and Lukas Maar},
  booktitle = {{ACSAC}},
  title = {{Manifest Problems: Analyzing Code Transparency for Android Application Bundles}},
  year = {2024}
}

In this paper, we present Defects-in-Depth, a two-fold analysis of the security of downstreamed Android kernels from the top device vendors. Initially, we analyze one-day exploits and kernel defense-in-depth mechanisms, allowing us to quantify the level of security that can be reached with these defenses. We then analyze the effectiveness and inclusion of the defenses in downstreamed Android kernels and found that the level of security that is actually reached is severely lacking.

@inproceedings{Maar2024DefectsInDepth,
  author = {Lukas Maar and Florian Draschbacher and Lukas Lamster and Stefan Mangard},
  booktitle = {{USENIX Security}},
  title = {{Defects-in-Depth: Analyzing the Integration of Effective Defenses against One-Day Exploits in Android Kernels}},
  year = {2024}
}

In this paper, we present SLUBStick, which provides a practical solution for converting a kernel heap vulnerability into a physical arbitrary r/w primitive with state-of-the-art kernel defenses enabled. Initially, SLUBStick exploits a timing side-channel on the SLUB allocator to reliably perform cross-cache reuse. SLUBStick then exploits code patterns in the kernel to convert a limited write (due to a heap vulnerability) into a page-manipulation primitive, enabling the physical arbitrary r/w primitive.

@inproceedings{Maar2024SLUBStick,
  author = {Lukas Maar and Stefan Gast and Martin Unterguggenberger and Mathias Oberhuber and Stefan Mangard},
  booktitle = {{USENIX Security}},
  title = {{SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel}},
  year = {2024}
}

In this paper, we present HEK-CFI, a novel approach leveraging Intel CET to protect control-flow data during system events, function pointers, operation table pointers, and return addresses. We implement and evaluate a HEK-CFI proof-of-concept, demonstrating reasonable performance overhead while providing superior protection compared to other kernel CFI schemes.

@inproceedings{Maar2024HEKCFI,
  author = {Lukas Maar and Pascal Nasahl and Stefan Mangard},
  booktitle = {{AsiaCCS}},
  title = {{Beyond the Edges of Kernel Control-Flow Hijacking Protection with HEK-CFI}},
  year = {2024}
}

@inproceedings{Gast2024Remote,
  author = {Stefan Gast and Jonas Juffinger and Lukas Maar and Christoph Royer and Andreas Kogler and Daniel Gruss},
  booktitle = {{FC}},
  title = {{Remote Scheduler Contention Attacks}},
  year = {2024}
}

In this paper, we present DOPE, a novel approach leveraging Intel PKS to protect sensitive data from data-oriented attacks. We implement and evaluate a DOPE proof-of-concept, demonstrating reasonable performance overhead while providing superior protection compared to other kernel data protection schemes.

@inproceedings{Maar2023DOPE,
  author = {Lukas Maar and Martin Schwarzl and Fabian Rauscher and Daniel Gruss and Stefan Mangard},
  booktitle = {{ACSAC}},
  title = {{DOPE: DOmain Protection Enforcement with PKS}},
  year = {2023}
}