Crashing the Party - Pwning Control Flow Integrity w SegFault Oriented Programming

The talk opens with a familiar idea: when a program makes an invalid memory access, the kernel delivers a segmentation fault and the process normally dies. The speakers argue that this crash can instead become a controlled loop. They contrast it with code-reuse attacks such as return-oriented and sigreturn-oriented programming, which Intel CET is built to stop, and review the two CET parts: the shadow stack and indirect branch tracking.

The middle section explains Linux signal delivery. A handler is registered with sigaction, the kernel saves register state into a frame on the stack, and sigreturn restores it. The key observation is that the shadow stack pointer is validated only after the frame has already been restored, so a forged frame can still set registers before the fault fires. The presenters combine tricks for controlling handler arguments and pivoting to fake frames, then demonstrate on nginx 1.4.0 with a known overflow and shadow stacks enabled. A backward variant abuses the restorer field to build a recursive shadow stack.

The closing section covers mitigations. The team's patch blocks the backward variant by rejecting restorer values with the top bit set. The forward technique relies on deeper user-to-kernel transition weaknesses, which are harder to fix and will take time. The takeaway is that signal handling is a real gap in hardware CFI, and defenders should watch for kernel changes. Code and the paper are in their repository.