A little Introduction to Control Flow Integrity
summary
Concrete defenses and limits: memory protections (ASLR, NX) plus stack canaries reduce exploitability; hardware and compiler features aim to stop hijacking even with arbitrary reads/writes so long as page permissions don’t change. Implementations include shadow stacks (Intel CCT, guarded control stack) and pointer authentication (ARM PAC, Apple A12 → ARM64E); software approaches include Microsoft Control Flow Guard and Clang CFI. PAC’s small tag can be as weak as 15 bits (~1/32k guess, worst case 3 bits → 1/8). Shadow stacks are deployed and effective; PAC and IBT/BTI trade performance, compatibility, and granularity.
AI-written summary · about
chapters (14)
- 0:00Introduction to security
- 10:05Stack canaries
- 17:52ASLR
- 20:14Non-executable memory
- 23:15ROP and JOP
- 28:38Broadening the threat model
- 34:26Shadow stacks
- 37:04Pointer authentication
- 52:13Forward edge CFI
- 59:02Microsoft CFG
- 1:07:03Clang CFI
- 1:18:27Hardware CFI
- 1:22:06PAC for call targets
- 1:27:42Q&A and conclusion
related talks
01h 34mA Little Introduction to Control Flow Integrity in C++
44mLinux Kernel Control-Flow Integrity Sup...
01h 05mHow to Survive the Hardware Assisted Control-Flow Integrity Enforcement
27mControl Flow Integrity on RISC-V
45mControl Flow Integrity in the Linux Kernel
39mControl Flow Integrity in the Linux Kernel
41mRISC-V Control-Flow Integrity (CFI)
20mControl Flow Integrity on RISCV