BEGIN:VCALENDAR VERSION:2.0 PRODID:Data::ICal 0.24 BEGIN:VEVENT DESCRIPTION: 'Title: Crashing the Party: Pwning Control-Flow Integrity wi th\n Segmentation Fault-Oriented Programming\n Tags: DEF CON Official Talk | Demo ๐Ÿ’ป | Tool ๐Ÿ› | Exploit ๐Ÿชฒ\n When: Friday\, Aug 7\, 11: 30 - 12:30 PDT\n Where: LVCCW Level 1 Hall 3 1007 (Main Track 2) and DCT V-2 - [1]Map\n\n Description:\n\n A program crashes with a segmentatio n fault. Then\, it crashes again.\n And again. What looks like crazy beh aviour is actually an exploit\,\n running one crash at a time.\n\n In this talk\, we present Segmentation Fault-Oriented Programming\n (SFOP)\ , a novel exploitation technique that weaponizes 12 previously\n unknown weaknesses in the Linux kernel's handling of signals to\n execute arbit rary code. SFOP is designed to bypass Intel CET\, the most\n widely depl oyed hardware Control-Flow Integrity (CFI) scheme on modern\n x86-64 sys tems\, built to stop classic code-reuse attacks such as\n Return-Oriente d Programming (ROP) and Sigreturn-Oriented Programming\n (SROP). Unlike previous CFI bypass techniques\, SFOP is a\n general-purpose technique t hat can by-default reliably exploit any\n vulnerable x86-64 application with Intel CET enabled\, becoming the\n lowest-hanging fruit attack afte r Intel CET.\n\n We will show how SFOP bypasses CFI and turns a single\n memory-corruption vulnerability into arbitrary code execution on\n re al-world targets. Through practical exploits\, we demonstrate that\n wha t appears to be a process trapped in a crash loop is\, in reality\,\n at tacker-controlled execution progressing fault by fault. Finally\, we\n d iscuss the underlying weaknesses that make SFOP possible and the\n mitig ations needed to defend against this new class of attacks.\n\n Our paper has a ~50 references\, like most academic papers. We have\n references to the Linux kernel lines that showcase the vulnerabilities\n we find\, even! Here we copy paste our references\, but everything is\n properly o rdered in the paper.\n\n [1] LMS Phrack 40. Bypassing cet & bti with fun ctional oriented\n programming. https://phrack.org/issues/71/7_md. (29-1 0-2025). [2]\n Martin Abadi\, Mihai Budiu\, Ulfar Erlingsson\, and Jay L igatti.\n Control-flow integrity. In Proceedings of the 12th ACM Confere nce on\n Computer and Communications Security\, CCS โ€™05\, page 340โ€“3 53\, New\n York\, NY\, USA\, 2005. Association for Computing Machinery. [3] Marcos\n Bajo and Christian Rossow. Await() a second: evading contro l flow\n integrity by hijacking c++ coroutines. In Proceedings of the 34 th\n USENIX Conference on Security Symposium\, SEC โ€™25\, USA\, 2025. U SENIX\n Association. [4] Markus Bauer\, Ilya Grishchenko\, and Christian Rossow.\n Typro: Forward cfi for c-style indirect function calls using type\n propagation. In Proceedings of the 38th Annual Computer Security\ n Applications Conference\, ACSAC โ€™22\, page 346โ€“360\, New York\, NY \,\n USA\, 2022. Association for Computing Machinery. [5] Lucas Becker\, \n Matthias Hollick\, and Jiska Classen. Sok: on the effectiveness of\n control-flow integrity in practice. In Proceedings of the 18th USENIX\n Conference on Offensive Technologies\, WOOTโ€™24\, USA\, 2024. USENIX\n Association. [6] Lorenzo Binosi\, Gregorio Barzasi\, Michele Carminati\, \n Stefano Zanero\, and Mario Polino. The Illusion of Randomness: An\n Empirical Analysis of Address Space Layout Randomization\n Implementati ons. In Proceedings of the 2024 on ACM SIGSAC Conference\n on Computer a nd Communications Security\, 2024. [7] Tyler Bletsch\,\n Xuxian Jiang\, Vince W. Freeh\, and Zhenkai Liang. Jump-oriented\n programming: A new c lass of code-reuse attack. In Proceedings of the\n ACM Symposium on Info rmation\, Computer and Communications Security\,\n ASIACCS\, 2011. [8] E rik Bosman. x86: Srop mitigation: implement signal\n counting. https://l kml.org/lkml/2014/5/15/858. (12-11-2025). [9] Erik\n Bosman and Herbert Bos. Framing signals - a return to portable\n shellcode. In 2014 IEEE Sy mposium on Security and Privacy\, pages\n 243โ€“258\, 2014. [10] Nichola s Carlini\, Antonio Barresi\, Mathias\n Payer\, David Wagner\, and Thoma s R. Gross. Control-Flow bending: On the\n effectiveness of Control-Flow integrity. In 24th USENIX Security\n Symposium (USENIX Security 15)\, p ages 161โ€“176\, Washington\, D.C.\,\n August 2015. USENIX Association. [11] Chromium. syscall sets.cc -\n chromium github.\n https://github.c om/chromium/chromium/blob/main/sandbox/linux/seccomp-bpf-helpers/syscall\n sets.cc#L353. (12-11-2025). [12] Exploit Database. Nginx 1.3.9 - 1.4.0\ n - chuncked encoding stack buffer overflow (metasploit).\n https://ww w.exploit-db.com/exploits/25775. (29-10-2025). [13] V8\n Developers. Con trol-flow integrity in v8.\n https://v8.dev/blog/control-flow-integrity. (29-10-2025). [14] Docker\n Docs. Seccomp security profiles for docker. \n https://docs.docker.com/engine/security/seccomp/. (12-11-2025). [15]\ n Victor Duta\, Fabian Freyer\, Fabio Pagani\, Marius Muench\, and Crist iano\n Giuffrida. Let me unwind that for you: Exceptions to backward-edg e\n protection. In Symposium on Network and Distributed System Security\ n (NDSS)\, 2023. [16] Mozilla Firefox. Sandboxfilter.cpp - firefox\n g ithub.\n https://github.com/mozilla-firefox/firefox/blob/main/security/s andbox/linux/SandboxFilter.cpp#L1178.\n (12-11-2025). [17] Alexander J. Gaidis\, Joao Moreira\, Ke Sun\, Alyssa\n Milburn\, Vaggelis Atlidakis\, and Vasileios P. Kemerlis. Fineibt:\n Fine-grain control-flow enforceme nt with indirect branch tracking. In\n Proceedings of the 26th Internati onal Symposium on Research in\n Attacks\, Intrusions and Defenses\, RAID โ€™23\, page 527โ€“546\, New\n York\, NY\, USA\, 2023. Association for Computing Machinery. [18] GNU.\n Gcc wiki - vtv. https://gcc.gnu.org/wik i/vtv. (12-11-2025). [19] GNU.\n Program instrumentation options.\n ht tps://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html.\n (12-11- 2025). [20] Yingjie Guo\, Liwei Chen\, and Gang Shi.\n Function-oriented programming: A new class of code reuse attack in c\n applications. In 2 018 IEEE Conference on Communications and Network\n Security (CNS)\, pag es 1โ€“9\, 2018. [21] Enes Goktas\, Elias\n Athanasopoulos\, Herbert Bos \, and Georgios Portokalidis. Out of\n control: Overcoming control-flow integrity. In 2014 IEEE Symposium on\n Security and Privacy\, pages 575โ €“589\, 2014. [22] Hong Hu\, Zheng Leong\n Chua\, Sendroiu Adrian\, Prat eek Saxena\, and Zhenkai Liang. Automatic\n generation of Data-Oriented exploits. In 24th USENIX Security\n Symposium (USENIX Security 15)\, pag es 177โ€“192\, Washington\, D.C.\,\n August 2015. USENIX Association. [2 3] Hong Hu\, Shweta Shinde\, Sendroiu\n Adrian\, Zheng Leong Chua\,Prate ek Saxena\, and Zhenkai Liang.\n Data-oriented programming: On the expre ssiveness of non-control data\n attacks. In 2016 IEEE Symposium on Secur ity and Privacy (SP)\, pages\n 969โ€“986\, 2016. [24] Intel. A technical look at intelยฎ control-flow\n enforcement technology.\n https://www. intel.com/content/www/us/en/developer/articles/technical/technical-look-co ntrol-flow-enforcement-technology.html.\n (29-10-2025). [25] Seunghoon J eong\, Jaejoon Hwang\, Hyukjin Kwon\, and\n Dongkyoo Shin. A cfi counter measure against got overwrite attacks.\n IEEE Access\, 8:36267โ€“36280\, 2020. [26] Linux Kernel. Control-flow\n enforcement technology (cet) sh adow stack.\n https://docs.kernel.org/arch/x86/shstk.html. (12-11-2025). [27] LLVM.\n Control flow integrity design documentation.\n https://c lang.llvm.org/docs/ControlFlowIntegrityDesign.html.\n (12-11-2025). [28] Linux manual page. Sigaction(2) - linux manual\n page. https://man7.org /linux/man-pages/man2/sigaction.2.html.\n (05-10-2025). [29] Ben Niu and Gang Tan. Modular control-flow\n integrity. In Proceedings of the 35th ACM SIGPLAN Conference on\n Programming Language Design and Implementati on\, PLDI โ€™14\, page\n 577โ€“587\, New York\, NY\, USA\, 2014. Associa tion for Computing\n Machinery. [30] PaX. Address space randomization.\n https://pax.grsecurity.net/docs/aslr.txt\, 2003. (12-11-2025). [31]\n Aravind Prakash\, Xunchao Hu\, and Heng Yin. vfguard: Strict protection\n for virtual function calls in cots c++ binaries. In Proceeding of the\n Annual Network and Distributed System Security Symposium (NDSS)\, 01\n 2015. [32] Bootlin Elixir Cross Referencer. create rstor token (linux\n kernel source code).\n https://elixir.bootlin.com/linux/v6.15.2/source /arch/x86/kernel/shstk.c#L64.\n (29-10-2025). [33] Bootlin Elixir Cross Referencer. get shstk data\n (linux kernel source code).\n https://eli xir.bootlin.com/linux/v6.15.2/source/arch/x86/kernel/shstk.c#L272.\n (29 -10-2025). [34] Bootlin Elixir Cross Referencer. libc sigaction\n (glibc source code).\n https://elixir.bootlin.com/glibc/glibc-2.33/source/sysd eps/unix/sysv/linux/sigaction.c#L42.\n (29-10-2025). [35] Bootlin Elixir Cross Referencer. pte mkwrite shstk\n (linux kernel source code).\n h ttps://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/include/asm/pgtabl e.h#L491.\n (29-10-2025). [36] Bootlin Elixir Cross Referencer. rt sigac tion\n (linux kernel source code).\n https://elixir.bootlin.com/linux/ v6.15.7/source/kernel/signal.c#L4644.\n (29-10-2025). [37] Bootlin Elixi r Cross Referencer. rt sigreturn l266\n (linux kernel source code).\n https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/kernel/signal\n 64.c#L266. (29-10-2025). [38] Bootlin Elixir Cross Referencer. rt\n sig return l275 (linux kernel source code).\n https://elixir.bootlin.com/lin ux/v6.15.2/source/arch/x86/kernel/signal\n 64.c#L275. (29-10-2025). [39] Bootlin Elixir Cross Referencer. setup\n signal shadow stack l364 (linu x kernel source code).\n https://elixir.bootlin.com/linux/v6.15.2/source /arch/x86/kernel/shstk.c#L364.\n (29-10-2025). [40] Bootlin Elixir Cross Referencer. setup signal\n shadow stack l370 (linux kernel source code) .\n https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/kernel/shst k.c#L370.\n (29-10-2025). [41] Bootlin Elixir Cross Referencer. Sigactio n (linux\n kernel source code).\n https://elixir.bootlin.com/linux/v6. 15.2/source/arch/x86/include/uapi/asm/signal.h#L93.\n (05-10-2025). [42] Bootlin Elixir Cross Referencer. Sigframe (linux\n kernel source code). \n https://elixir.bootlin.com/linux/v6.15.2/source/arch/x86/include/asm/ sigframe.h#L59.\n (05-10-2025). [43] Bootlin Elixir Cross Referencer. si gset t (glibc\n source code).\n https://elixir.bootlin.com/glibc/glibc -2.33/source/signal/bits/types/sigset\n t.h#L7. (29-10-2025). [44] Bootl in Elixir Cross Referencer. sigset t\n (linux kernel source code).\n h ttps://elixir.bootlin.com/linux/v6.15.7/source/arch/x86/include/asm/signal .h#L25.\n (29-10-2025). [45] AliAkbar Sadeghi\, Salman Niksefat\, and Ma ryam\n Rostamipour. Pure call oriented programming (pcop): chaining the\ n gadgets using call instructions. Journal of Computer Virology and\n Hacking Techniques\, 14:1โ€“18\, 05 2018. [46] Felix Schuster\, Thomas\n Tendyck\, Christopher Liebchen\, Lucas Davi\, Ahmad-Reza Sadeghi\, and\n Thorsten Holz. Counterfeit object-oriented programming: On the\n diffi culty of preventing code reuse attacks in c++ applications. In\n Proceed ings of the IEEE Symposium on Security and Privacy\, SP\, 2015.\n [47] H ovav Shacham. The geometry of innocent flesh on the bone:\n Return-into- libc without function calls (on the x86). In Proceedings\n of the ACM co nference on Computer and Communications Security\, CCS\,\n 2007. [48] sr oettger. Ierae ctf 2024.\n https://gist.github.com/sroettger/fe66f7eb0cb 10a8ebd1454875a7131ea.\n (29-10-2025). [49] Ubuntu. Compilerflags - ubun tu wiki.\n https://wiki.ubuntu.com/ToolChain/CompilerFlags. (29-10-2025) . [50]\n Chao Zhang\, Scott A. Carr\, Tongxin Li\, Yu Ding\, Chenyu Song \, Mathias\n Payer\, and Dawn Song. Vtrust: Regaining trust on virtual c alls. In\n Proceedings of the Annual Network and Distributed System Secu rity\n Symposium (NDSS)\, 2016. [51] Tianning Zhang\, Miao Cai\, Diming Zhang\,\n and Hao Huang. esrop attack: Leveraging signal handler to impl ement\n turing-complete attack under cfi defense. In Fengjun Li\, Kaitai Liang\,\n Zhiqiang Lin\, and Sokratis K. Katsikas\, editors\, Security and Privacy\n in Communication Networks\, pages 752โ€“769\, Cham\, 2023. Springer\n Nature Switzerland\n\n Speakers:Marcos "h3xduck" Bajo\,Rit vik "RoYalGamr" Goyal\n\n SpeakerBio: Marcos "h3xduck" Bajo\, CISPA Hel mholtz Center for\n Information Security\n\n Marcos Bajo aka h3xduck i s a security researcher and PhD student at\n the CISPA Helmholtz Center for Information Security in Germany. His\n research focuses on exploitat ion techniques and malware\, but more\n broadly\, he's interested in bre aking things others buildโ€”and\n building things to break things.\n\n SpeakerBio: Ritvik "RoYalGamr" Goyal\n\n Ritvik Goyal is a Senior Unde rgraduate in Mathematics and Scientific\n Computing at the Indian Instit ute of Technology Kanpur. He recently\n worked as a Research Intern at t he CISPA Helmholtz Center\, focusing on\n system security research regar ding Control Flow Integrity protections\n like Intel CET. He is a key me mber of the competitive CTF team Wiredin\n IITK and actively mentors stu dents in cybersecurity at Programming\n Club IIT Kanpur.\n\n '\n\n 1 . #LVCCW_Level1_Hall3\n\n\n DTEND:20260807T193000Z DTSTART:20260807T183000Z LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 1007 (Main Track 2) and DCTV- 2 SUMMARY:Crashing the Party: Pwning Control-Flow Integrity with Segmentation Fault-Oriented Programming END:VEVENT END:VCALENDAR