About Me:

Hey and welcome to my site. I am a security researcher from Austria. I defended my PhD titled Kernel Security in the Wild at the Institute of Information Security (former IAIK), Graz University of Technology. My research focuses on system security, with a particular focus on kernel attacks and defenses, side-channel attacks targeting the kernel, and Android kernel security.

Interests
  • System Security
  • Kernel Attacks and Defenses
  • Side-Channel Attacks
  • Android Kernel Security
Education
  • PhD in Computer Science, 2025
    Graz University of Technology
  • MSc in Electrical Engineering, 2022
    Graz University of Technology
  • BSc in Computer Science, 2022
    Graz University of Technology
  • BSc in Electrical Engineering, 2018
    Graz University of Technology

Blog

2026
From KernelSnitch to Practical msg_msg/pipe_buffer Heap KASLR Leaks
Lukas Maar
Info GitHub

Publications

2026
Clone2Pwn: A Systematic Security Analysis of Data Migration Tools in the Android Ecosystem
Florian Draschbacher, Lukas Maar, Lorenz Schumm, Rene Denifl, Lukas Treffner, Stefan Mangard
European Symposium on Research in Computer Security (ESORICS) 2026
CVE-2025-15515, CVE-2025-21060, CVE-2025-21061, CVE-2025-21062, CVE-2025-21064, CVE-2025-21078, CVE-2025-27387
Info BibTex GitHub
Eviction Notice: Reviving and Advancing Page Cache Attacks
Sudheendra Raghav Neela, Jonas Juffinger, Lukas Maar, Daniel Gruss
Network and Distributed System Security (NDSS) 2026
Artifacts evaluated: Available, Functional, Reproduced  CVE-2025-21691
Info BibTex GitHub Zenodo
2025
Kernel Security in the Wild
Lukas Maar
PhD Thesis
Info BibTex Slides
image:thesis
The Doom of Device Drivers: Your Android Device (Most Likely) has N-Day Kernel Vulnerabilities
Lukas Maar, Florian Draschbacher, Lorenz Schumm, Ernesto Martínez García, Stefan Mangard
USENIX Security Symposium 2025
Info BibTex Slides Poster
image:drivers
In this paper, we examine the security of Android devices against n-day exploitation. First, we identify kernel drivers accessible to untrusted apps, revealing a broader-than-expected kernel attack surface. Using public sources like git history, we then identify n-day vulnerabilities in these drivers. Finally, we perform a patch analysis that shows many remain unpatched for extended periods. This enables malicious actors to exploit n-days instead of relying on costly zero-days.
When Good Kernel Defenses Go Bad: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks
Lukas Maar, Lukas Giner, Daniel Gruss, Stefan Mangard
USENIX Security Symposium 2025
Artifacts evaluated: Available, Functional, Reproduced
Info BibTex GitHub Zenodo Slides Poster Black Hat USA Nullcon Berlin
ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago
Florian Draschbacher, Lukas Maar, Mathias Oberhuber, Stefan Mangard
USENIX Security Symposium 2025
Artifacts evaluated: Available  CVE-2024-20900, CVE-2024-43085, CVE-2025-24193, CVE-2024-54096
Info BibTex Zenodo Black Hat Asia
Cryptographic Least Privilege Enforcement for Scalable Memory Isolation
Martin Unterguggenberger, David Schrammel, Lukas Maar, Lukas Lamster, Vedad Hadzic, Stefan Mangard
IEEE International Symposium on Hardware Oriented Security and Trust (HOST) 2025
Info BibTex
KernelSnitch: Side-Channel Attacks on Kernel Data Structures
Lukas Maar, Jonas Juffinger, Thomas Steinbauer, Daniel Gruss, Stefan Mangard
Network and Distributed System Security (NDSS) 2025
Artifacts evaluated: Available, Functional, Reproduced  Pwnie Award Nominee
Info BibTex GitHub Slides Black Hat Asia Nullcon Berlin
Power-Related Side-Channel Attacks using the Android Sensor Framework
Mathias Oberhuber, Martin Unterguggenberger, Lukas Maar, Andreas Kogler, Stefan Mangard
Network and Distributed System Security (NDSS) 2025
Info BibTex
2024
Manifest Problems: Analyzing Code Transparency for Android Application Bundles
Florian Draschbacher, Lukas Maar
Annual Computer Security Applications Conference (ACSAC) 2024
Artifacts evaluated: Available, Functional, Reproduced  CVE-2023-21387
Info BibTex GitHub
Defects-in-Depth: Analyzing the Integration of Effective Defenses against One-Day Exploits in Android Kernels
Lukas Maar, Florian Draschbacher, Lukas Lamster, Stefan Mangard
USENIX Security Symposium 2024
Artifacts evaluated: Available, Functional, Reproduced
Info BibTex GitHub Slides
SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel
Lukas Maar, Stefan Gast, Martin Unterguggenberger, Mathias Oberhuber, Stefan Mangard
USENIX Security Symposium 2024
Artifacts evaluated: Available, Functional, Reproduced  CSAW'24 Europe Applied Research Competition (ARC) Finalist
Info BibTex Poster GitHub Slides
Beyond the Edges of Kernel Control-Flow Hijacking Protection with HEK-CFI
Lukas Maar, Pascal Nasahl, Stefan Mangard
ACM ASIA Conference on Computer and Communications Security (AsiaCCS) 2024
Info BibTex Slides
image:HEK-CFI
In this paper, we present HEK-CFI, a novel approach leveraging Intel CET to protect control-flow data during system events, function pointers, operation table pointers, and return addresses. We implement and evaluate a HEK-CFI proof-of-concept, demonstrating reasonable performance overhead while providing superior protection compared to other kernel CFI schemes.
Remote Scheduler Contention Attacks
Stefan Gast, Jonas Juffinger, Lukas Maar, Christoph Royer, Andreas Kogler, Daniel Gruss
Financial Cryptography (FC) 2024
Info BibTex
2023
DOPE: DOmain Protection Enforcement with PKS
Lukas Maar, Martin Schwarzl, Fabian Rauscher, Daniel Gruss, Stefan Mangard
Annual Computer Security Applications Conference (ACSAC) 2023
Artifacts evaluated: Functional
Info BibTex GitHub Slides
image:DOPE
In this paper, we present DOPE, a novel approach leveraging Intel PKS to protect sensitive data from data-oriented attacks. We implement and evaluate a DOPE proof-of-concept, demonstrating reasonable performance overhead while providing superior protection compared to other kernel data protection schemes.

Talks

2025
Kernel Security in the Wild
Lukas Maar
PhD Thesis
KernelSnitch: Side-Channel Attacks on Kernel Data Structures
Lukas Maar
Network and Distributed System Security (NDSS) 2025
Website Recording
2024
Beyond the Edges of Kernel Control-Flow Hijacking Protection with HEK-CFI
Lukas Maar
ACM ASIA Conference on Computer and Communications Security (AsiaCCS) 2024
2023
DOPE: DOmain Protection Enforcement with PKS
Lukas Maar
Annual Computer Security Applications Conference (ACSAC) 2023
Website

Awards and CVEs

2025
CVE-2025-15515, CVE-2025-21060, CVE-2025-21061, CVE-2025-21062, CVE-2025-21064, CVE-2025-21078, CVE-2025-27387
Clone2Pwn: A Systematic Security Analysis of Data Migration Tools in the Android Ecosystem
CVE-2025-21691
Eviction Notice: Reviving and Advancing Page Cache Attacks
Pwnie Award Nominee for Most Underhyped Research
KernelSnitch: Side-Channel Attacks on Kernel Data Structures
CVE-2024-54096, CVE-2024-20900, CVE-2024-43085, CVE-2025-24193
ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago
2024
CSAW'24 Europe Applied Research Competition (ARC) Finalist
SLUBStick: Arbitrary Memory Writes through Practical Software Cross-Cache Attacks within the Linux Kernel
2023
CVE-2023-21387
Manifest Problems: Analyzing Code Transparency for Android Application Bundles