Identifying Non-Control Security-Critical Data through Program Dependence Learning

arXiv:2108.12071v2 Announce Type: replace
Abstract: As control-flow protection gets widely deployed, it is difficult for attackers to corrupt control-data and achieve control-flow hijacking. Instead, data-oriented attacks, which manipulate non-control data, have been demonstrated to be feasible and powerful. In data-oriented attacks, a fundamental step is to identify non-control, security-critical data. However, critical data identification processes are not scalable in previous works, because they mainly rely on tedious human efforts to identify critical data. To address this issue, we propose a …

arxiv attackers attacks control corrupt critical critical data cs.cr data flow hijacking identify non program protection security