PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Control Flow Integrity: Theory, Mechanisms and Exploitation.

bugpwn.com | blog | #vulnerability-research | #memory-safety | #exploitation | #binary-exploitation | #hardening | #cfi | #mitigations | #code-reuse | #control-flow-integrity | #dop | #defenses | #exploitation-techniques | #defense-mechanisms | #data-oriented-programming
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A complete dive into Control Flow Integrity (CFI): formal definition, coarse- vs fine-grained designs, real-world implementations, limits, and Data-Oriented Programming as a bypass.
Published
Collected

Related coverage

blog · bugpwn.com
Counterfeit Object-Oriented Programming
Counterfeit Object-Oriented Programming (COOP) chains legitimate C++ virtual calls via vtables to bypass CFI. The guide covers gadget mechanics, countermeasures, and a hands-on exploitation lab.
blog · bugpwn.com
Binary Exploitation: Jump-Oriented Programming.
Jump-Oriented Programming chains gadgets ending in indirect jumps instead of ret, evading Intel CET shadow stacks; the article covers its history, dispatch architecture, and a hands-on bypass lab.
blog · bugpwn.com
Hardware Security: CHERI Capabilities In Depth.
CHERI (Capability Hardware Enhanced RISC Instructions) : définition, anatomie des capabilities, implémentations concrètes (Morello, CHERIoT), alliances industrielles, threat model et PoCs pratiques sur CheriBSD.
blog · bughunters.google.com
Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · bughunters.google.com
LLVM CFI and Cross-Language LLVM CFI Support for Rust
Google Bug Hunters partnered with the Rust community to add LLVM CFI and cross-language LLVM CFI (with KCFI variants) to the Rust compiler, strengthening control-flow integrity for Rust code.
blog · blog.trailofbits.com
A “proof” of Fermat’s Last Theorem that fits the margin
Trail of Bits found a Lean ≤4.33.1 bug: String.Pos.Raw.extract returns a full string where its spec says empty — enough to 'prove' Fermat's Last Theorem. Not a soundness flaw; fixed in 4.34.0-rc1.
Back