Isolation Failure From Shared Storage: Characterizing and Exploiting Page-Cache SCA Leakage Across Containers and VMs

The problem is that modern cloud platforms share the host page cache across containers and VMs, creating an OS-mediated microarchitectural timing side channel. The method involves unprivileged timing measurements to detect page-cache residency across Docker, gVisor, Kata Containers, and QEMU/KVM with various I/O paths. Experimental evidence shows the timing signal persists with shared host-cacheable file-backed objects like OverlayFS and virtio-fs, but direct I/O and dedicated block devices attenuate it; a case study recovers coarse-grained activity from a WordPress/MySQL deployment. This matters because it characterizes page-cache attacks as OS-mediated channels, motivating coordinated hardware, virtualization, and OS support for timing isolation.