Enforcing C/C++ Type and Scope at Runtime for Control-Flow and Data-Flow Integrity
Mohannad Ismail, Christopher Jelesnianski, Yeongjin Jang, Changwoo Min, Wenjie Xiong · 2024
Control-flow hijacking and data-oriented attacks are becoming more sophisticated. These attacks, especially data-oriented attacks, can result in critical security threats, such as leaking an SSL key. Data-oriented attacks are hard to defend against with acceptable performance due to the sheer amount of data pointers present. The root cause of such attacks is using pointers in unintended ways; fundamentally, these attacks rely on abusing pointers to violate the original scope they were used in or the original types that they were declared as.