New Exploit Technique Bypasses Intel CET via Segfaults

A research paper titled “Crashing Through Defenses: Exploiting Segfaults and Chaining around Intel CET” (repository signal-sfop/sfop) has been published on GitHub, prepared — judging by the file name — for the Security and Privacy (S&P) conference. The document describes an approach the authors designate by the abbreviation SFOP.

The stated subject of the research is the exploitation of segfaults (segmentation faults) and the construction, on their basis, of chains that make it possible to bypass Intel CET (Control-flow Enforcement Technology). CET is a hardware mechanism built into modern Intel processors and intended to make hijacking the control flow more difficult: it checks the correctness of returns and indirect jumps, thwarting classic techniques such as ROP and JOP.

The very title of the work hints at its idea: instead of storming the defense head-on, the attack in a sense “falls through” it, exploiting the system's own reaction to failure conditions. Bypassing mechanisms that were originally conceived as a “last line of defense” regularly becomes the subject of academic publications — and the appearance of yet another technique aimed at CET shows that hardware control-flow protection is no panacea.

The full text is available as a PDF file in the project repository. The technical details of the method, the conditions under which it applies, and an assessment of its effectiveness are contained in the paper itself; it is premature to judge the implementation details from the title alone.

Source: Lobsters