Out of Control: Overcoming Control-Flow Integrity

TLDR

Control‑Flow Integrity (CFI) has attracted attention because conventional defenses such as ASLR, DEP, and stack cookies fail to stop determined attackers, yet practical deployment is hindered by the need for source/debug information and high performance costs. This work aims to evaluate whether relaxed CFI schemes can still thwart code‑reuse attacks and determine the difficulty of bypassing them. The authors analyze binary‑level, performance‑optimized CFI that allows a looser control‑flow policy, and assess its gadget availability and exploitability. They demonstrate that even with relaxed CFI, return‑oriented programming remains feasible via two new gadget types, and provide a working exploit against Internet Explorer that defeats contemporary CFI protections.

Abstract

As existing defenses like ASLR, DEP, and stack cookies are not sufficient to stop determined attackers from exploiting our software, interest in Control Flow Integrity (CFI) is growing. In its ideal form, CFI prevents flows of control that were not intended by the original program, effectively putting a stop to exploitation based on return oriented programming (and many other attacks besides). Two main problems have prevented CFI from being deployed in practice. First, many CFI implementations require source code or debug information that is typically not available for commercial software. Second, in its ideal form, the technique is very expensive. It is for this reason that current research efforts focus on making CFI fast and practical. Specifically, much of the work on practical CFI is applicable to binaries, and improves performance by enforcing a looser notion of control flow integrity. In this paper, we examine the security implications of such looser notions of CFI: are they still able to prevent code reuse attacks, and if not, how hard is it to bypass its protection? Specifically, we show that with two new types of gadgets, return oriented programming is still possible. We assess the availability of our gadget sets, and demonstrate the practicality of these results with a practical exploit against Internet Explorer that bypasses modern CFI implementations.