Publications

Page deduplication is a common optimization in modern operating systems and hypervisors that reduces memory consumption by merging identical pages into a single physical copy. Prior work has shown that deduplication can introduce side channels by exploiting timing differences in Copy-on-Write faults for attacker-crafted page replicas. Consequently, page deduplication is often disabled by default.

In this paper, we find that even when page deduplication is disabled, zero-filled memory pages remain an always-on, largely overlooked source of shared state. We demonstrate that read-only accesses to zero-pages can be exploited via cache attacks on the shared physical backing page, enabling purely read-based side-channel attacks that preserve sharing. Based on these effects, we introduce Zepade attacks, which exploit zero-page deduplication.

We demonstrate the impact of Zepade in three directions. First, we show that zero-page effects break the isolation assumptions of sparse, linear-scan ORAM-style key-value stores, leaking which entries are populated even though the implementation performs a fixed scan over all entries. Second, we show that zero-page access patterns enable application and workload fingerprinting, including inside Intel TDX confidential virtual machines, and demonstrate website fingerprinting with an accuracy above 90%. Third, we characterize the primitive through covert channels across processes, containers, browsers, and KSM-enabled virtual machines.

Finally, we confirm that removing zero-page deduplication in the Linux kernel eliminates the side channel with no measurable performance overhead on SPEC CPU 2017 and minimal memory overhead. Our results indicate that zero-page deduplication is not a benign corner case of deduplication, but an always-on OS-created shared-memory primitive that must be considered in side-channel threat models.

@inproceedings{einzinger2027zepade,
  title     = {Zepade Attacks: Exploiting Zero-Page Deduplication for Side-Channel Attacks},
  author    = {Einzinger, Simon and Hornetz, Tristan and Schwarz, Michael},
  booktitle = {48th IEEE Symposium on Security and Privacy (S\&P)},
  year      = {2027},
  address   = {Montreal, Canada}
}