The Good, the Bad, and the Weird

Summary: Trail of Bits describes "weird machines" as partially Turing-complete code snippets that arise from loose contracts, where a program undergoes more state changes than intended, and cites the ListItem::TrySetItem function as an example where an attacker who overwrote the m_next pointer can use the function to check and then leak or set memory at an arbitrary address. The post traces Microsoft's tightening of the execution contract from read-implies-execute in Windows NT in 1995, to NX/DEP in Windows XP SP2 in 2003, ASLR in Windows Vista in 2006, and Control Flow Guard in Windows 8.1/10 in 2016.
Key Takeaway: Each mitigation Microsoft shipped over two decades narrowed the set of valid indirect branch destinations, and the post states this makes exploitation harder and the need for weird machines greater, dramatically increasing their value to attackers. The tooling to automatically identify and classify weird machines does not yet exist, so the ability to prove a given vulnerability unexploitable remains out of reach.

Read the original at Trail of Bits Blog ↗