The Challenges of Deploying Security Mitigations

Summary: Trail of Bits set out to apply control flow integrity to Facebook's osquery, enabling Visual Studio's Control Flow Guard on the Windows build in about 15 minutes with a two-line CMake change, while ClangCFI on the Linux build remained unfinished after weeks of effort. The gap stems from ClangCFI's stricter requirements: it validates type signatures at indirect call sites, requires whole-program analysis and link-time optimization, and must be enabled for every object file and static library, so osquery's statically linked dependency tree would all need CFI. The team reported two clang bugs and could not produce a CFI-enabled strongSwan because libstrongswan's OOP-like C system wraps most indirect calls in an interface that fails ClangCFI's checks.
Key Takeaway: The more secure mitigation is the one still not shipped: a CFGuard-protected osquery for Windows exists now, while the ClangCFI version for Linux is a work-in-progress after weeks of trial and error, and a linker that does not inspect objects for ClangCFI protections will emit a binary that fails runtime CFI checks without reporting an error.

Read the original at Trail of Bits Blog ↗