Did you know that C++ is UNSAFE? Okay, yeah, you probably did know that. Everyone seems to be talking about how unsafe C++ is nowadays.
In most talks about C++ and safety, the subject is something about how to make C++ safer--whether it's through new language or library features, new tooling, or new best practices. In this talk, we'll take a different view of things: We're going to _accept_ that C++ is unsafe and _accept_ that large C++ programs are probably going to have memory safety bugs, and we're going to look at what kinds of technologies we can build to make it _less catastrophically unsafe_.
Control flow integrity technologies are designed to prevent (or at least make it far more difficult) threat actors from leveraging memory safety bugs into Remote Code Execution (RCE) vulnerabilities.
In this talk, we'll discuss the history of control flow integrity technologies. We'll start at the beginning, and look at how in the early days of the internet, memory safety bugs were exploited by attackers to overwrite return addresses on the stack and thus hijack program control flow. We'll look at some of the early defenses that were developed against these exploits, including stack canaries, address-space layout randomization, and non-executable memory.
These technologies were great advances, but they were all incomplete defenses. We'll look at how attackers became craftier and developed increasingly sophisticated exploits to bypass these early defenses, and then we'll look at two recent technologies that provide more comprehensive protection: Shadow Stacks and Pointer Authentication.
In the latter part of this talk, we'll turn our attention to a set of modern defenses for protecting function pointers, including Microsoft Control Flow Guard (CFG), Clang Control Flow Integrity (Clang CFI), Indirect Branch Tracking (IBT/BTI), and Pointer Authentication.
While this talk is a survey of these technologies, there will be plenty of low-level details about how each of these technologies work, what their tradeoffs are, how they compare to each other--or complement each other, and where each of them can be used.
View Slides
James McNellis is software engineer at Roblox, where he works on C++ software security. Prior to joining Roblox in 2022, he was a software engineer at Microsoft where he worked on the Visual C++ compiler and runtime libraries, and Microsoft's Time Travel Debugging (TTD) reverse debugging toolkit.