SoK: On the Effectiveness of Control-Flow Integrity in Practice
summary
Systematic cataloging of deployed CFI schemes pairs with a large-scale binary analysis of 33 Android images (seven vendors) and two Windows builds across architectures, using constant propagation and symbolic execution on the CFI slowpath. The study finds up to 94% of binaries unprotected and 93% of libraries unprotected, with 77,000 files analyzed, meaning every binary depends on unprotected libraries so CFI enforcement is largely ineffective and Android rollout stagnates while Windows still has 2.63% unprotected.
AI-written summary · about
chapters (17)
- 0:00CFI effectiveness research
- 0:29Memory corruption vulnerabilities
- 1:11CFI prevents exploits
- 2:20CFI implementation and attacker model
- 3:26CFI with LLVM
- 5:12Equivalence classes in CFI
- 6:34Industry adoption of CFI
- 7:59Academic vs industry CFI granularity
- 9:01CFI adoption barriers
- 9:43Android CFI analysis overview
- 10:47Android CFI pipeline
- 13:56Symbolic execution of CFI checks
- 14:16Android CFI deployment stats
- 16:19CFI coverage trends
- 17:02Equivalence class distribution
- 18:45Key takeaways
- 19:48Q&A
related talks
01h 34mA Little Introduction to Control Flow Integrity in C++
26mEfficient Protection of Path-Sensitive Control Security
01h 46mA little Introduction to Control Flow Integrity
28mCOFI break
44mLinux Kernel Control-Flow Integrity Sup...
45mControl Flow Integrity in the Linux Kernel
01h 05mHow to Survive the Hardware Assisted Control-Flow Integrity Enforcement
33mIdentifying Multi-Binary Vulnerabilities in Embedded Firmware at Scale