Cyber Risks · Trail of Bits Blog

Let’s talk about CFI: clang edition

Summary: Trail of Bits explains control flow integrity (CFI), an exploit mitigation like stack cookies, DEP, and ASLR that enforces at run time the control flow graph the compiler determined at compile time. The post covers clang's CFI implementation, in mainline since version 3.7 and tested on clang 3.9, including the -flto, -fsanitize=cfi, and -fvisibility=hidden flags and checks such as cfi-icall, cfi-vcall, cfi-nvcall, and cfi-unrelated-cast.

Bottom line: CFI's indirect-call check only blocks gadgets that do not start at a function boundary and calls whose signatures differ, so an attacker who swaps a call from delete_user(const char *username) to make_admin(const char *username) passes the check; the protection also does not work across shared library boundaries.

Read the original at Trail of Bits Blog ↗