Skip to content
STIMSMITH

Address Space Conflict

Concept

An address space conflict is a condition in which multiple instruction sequences, program regions, or analysis artifacts compete for the same memory addresses, preventing them from coexisting or executing as intended within a shared address space. The term has been documented in two distinct domains: (1) processor fuzzing for transient execution vulnerabilities, where training and transient instruction sequences cannot be linearly placed at desired addresses, and (2) binary program analysis, where in-process instrumentation tools disrupt the native memory layout of the target program. In both cases, the conflict undermines the controlling or observing tool's ability to faithfully produce or measure execution behavior.

First seen 6/13/2026
Last seen 6/13/2026
Evidence 4 chunks
Wiki v1

WIKI

Overview

An address space conflict arises when different instruction sequences—or different artifacts produced by an analysis tool—must occupy the same memory addresses, but their contents, semantics, or side effects are incompatible. The conflict prevents the affected sequences from being linearly arranged in memory and from being executed without mutual interference. The concept has been articulated in two independent research contexts:

  1. Processor fuzzing for transient execution bugs (DejaVuzz, ASPLOS '25), where a fuzzer must place both microarchitectural-training instructions and transient-window instructions in a single shared memory image.
  2. Dynamic binary analysis / taint tracking (HALF, arXiv 2512.22043), where in-process instrumentation pollutes the target's native memory layout.
READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

1 connections
Dynamic Swappable Memory ← implements 100% 2e
Dynamic swappable memory resolves address space conflicts by time-sharing the address space for different instruction sequences.

LINKED ENTITIES

1 links
Dynamic Swappable Memory IMPLEMENTS Extracted graph relationship

CITATIONS

7 sources
7 citations — click to expand
[1] In processor fuzzing, the root cause of the difficulty in arranging training and transient instruction sequences linearly is the address space conflict: training instructions may occupy addresses needed for transient windows, and different training instructions cannot be tested at the same address. DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking Assisted Processor Fuzzing
[2] Three categories of conflicts arise when training and transient sequences share a linear address space: W1 (branch-training overlapping the transient trigger address), W2 (training conflicting with register-setup assignments), and W3 (transient and training intermixed so that substitution invalidates the window). DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking Assisted Processor Fuzzing
[3] Existing fuzzers are limited by address space conflicts: template-based fuzzers (IntroSpectre, TEESec) cover only specific templates, while random-based fuzzers such as SpecDoctor must discard transient windows containing backward jumps. DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking Assisted Processor Fuzzing
[4] Dynamic Swappable Memory (swapMem) resolves address space conflicts by defining a swappable region whose contents are replaced at runtime, allowing the full address space to be reused across training and transient sequences and enabling exploration of different training effects. DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking Assisted Processor Fuzzing
[5] swapMem enhances microarchitectural controllability as the isolation primitive that resolves address space conflicts; switching instruction sequences on demand at different stages allows the fuzzer to control the microarchitecture to trigger desired transient execution behaviors. DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking Assisted Processor Fuzzing
[6] In dynamic binary analysis, traditional in-process analysis tools trigger severe address-space conflicts that disrupt the native memory layout of the target, causing layout-sensitive exploits and evasive malware to deviate from their intended execution paths or fail entirely. HALF: Hollowing Analysis Framework for Binary Programs with Kernel Module Assistance
[7] DejaVuzz introduces swapMem as a dynamic swappable memory model and differential information flow tracking as its two novel operating primitives, with the former addressing microarchitectural controllability by resolving conflicts between instruction sequences through time-sharing the address space. DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking Assisted Processor Fuzzing