# Flush+Flush: A Fast and Stealthy Cache Attack

arXiv: https://arxiv.org/abs/1511.04594 · HTML: https://mlsanity.com/paper/1511.04594/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Nov 2015.

## Built on by (most cited first, 10 of 10)

- [HW-V2W-Map: Hardware Vulnerability to Weakness Mapping Framework for Root Cause Analysis with GPT-assisted Mitigation Suggestion](https://mlsanity.com/paper/2312.13530/) (2023)
- [A Novel Malware Detection Mechanism based on Features Extracted from Converted Malware Binary Images](https://mlsanity.com/paper/2104.06652/) (2021)
- [CloudShield: Real-time Anomaly Detection in the Cloud](https://mlsanity.com/paper/2108.08977/) (2021)
- [MAD-EN: Microarchitectural Attack Detection through System-wide Energy Consumption](https://mlsanity.com/paper/2206.00101/) (2022)
- [Design of secure and robust cognitive system for malware detection](https://mlsanity.com/paper/2208.02310/) (2022)
- [Side Channel-Assisted Inference Leakage from Machine Learning-based ECG Classification](https://mlsanity.com/paper/2304.01990/) (2023)
- [Attacking Slicing Network via Side-channel Reinforcement Learning Attack](https://mlsanity.com/paper/2409.11258/) (2024)
- [uGen: An Agentic Framework for Generating Microarchitectural Attack PoCs](https://mlsanity.com/paper/2605.15503/) (2026)
- [SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channels](https://mlsanity.com/paper/2608.02995/) (2026)
- [Detokenization Leaks: Reconstructing Local LLM Outputs From Cache Traces](https://mlsanity.com/paper/2609.06674/) (2026)

## Abstract (arXiv)

Research on cache attacks has shown that CPU caches leak significant information. Proposed detection mechanisms assume that all cache attacks cause more cache hits and cache misses than benign applications and use hardware performance counters for detection. In this article, we show that this assumption does not hold by developing a novel attack technique: the Flush+Flush attack. The Flush+Flush attack only relies on the execution time of the flush instruction, which depends on whether data is cached or not. Flush+Flush does not make any memory accesses, contrary to any other cache attack. Thus, it causes no cache misses at all and the number of cache hits is reduced to a minimum due to the constant cache flushes. Therefore, Flush+Flush attacks are stealthy, i.e., the spy process cannot be detected based on cache hits and misses, or state-of-the-art detection mechanisms. The Flush+Flush attack runs in a higher frequency and thus is faster than any existing cache attack. With 496 KB/s in a cross-core covert channel it is 6.7 times faster than any previously published cache covert channel.