Thread-Level Attack-Surface Reduction
Florian Rommel, Christian Dietrich, Andreas Ziegler, Illia Ostapyshyn, Daniel Lohmann · 2023
Existing debloating techniques designed to prevent buffer-overflow exploits through return-oriented programming do not differentiate roles within a process or binary, allowing all threads access to the full program functionality. For example, a worker thread that handles client connections (highest attack exposure) still has access to all the code that the management thread needs (highest potential fallout).