A Little Introduction to Control Flow Integrity in C++
summary
Survey of concrete defenses: shows the Morris worm 1988 exploit that nags the need for stack canaries (GCC 1997 / MSVC 2005), OS features like ASLR and NX (early 2000s), and the move to shadow stacks (Intel CFT/CCT 2020, low overhead) and ARM pointer authentication (PAC, ARMv8.3/A12 2018) that signs pointers (typical PAC = 15 bits, worst case 3 bits → 1/8 guess chance). Compares Microsoft CFG (2014, 2 TB bitmap ~67 MB committed) and Clang CFI (type-checked, needs LTO), notes IBT/BTI hardware helpers and real-world perf tradeoffs.
AI-written summary · about
chapters (14)
- 0:00Control flow integrity intro
- 1:26Finger daemon memory bug
- 10:11Stack canaries defense
- 16:45Address space layout randomization
- 19:10Non-executable memory
- 22:20Return oriented programming
- 26:32Threat model refinement
- 29:43Shadow stacks x86
- 37:02Pointer auth ARM
- 44:39Function pointer attacks
- 55:22Microsoft CFG indirect calls
- 1:04:05Clang CFI indirect calls
- 1:19:19Hardware-assisted CFI
- 1:27:18Summary performance
related talks
01h 46mA little Introduction to Control Flow Integrity
44mLinux Kernel Control-Flow Integrity Sup...
01h 05mHow to Survive the Hardware Assisted Control-Flow Integrity Enforcement
39mControl Flow Integrity in the Linux Kernel
45mControl Flow Integrity in the Linux Kernel
41mRISC-V Control-Flow Integrity (CFI)
27mFiner-grained kernel control flow integrity and challenges
27mControl Flow Integrity on RISC-V