3 ms·

AFAIK (IE my engineers working on it tell me :P) that CFI was essentially too slow in practice (IE > 5% overhead) until new implementation techniques were devel

AFAIK (IE my engineers working on it tell me :P) that CFI was essentially too slow in practice (IE > 5% overhead) until new implementation techniques were developed in the past couple years (literally. I'm pretty sure the last good paper on this was in 2014). " IE already ships with a forward CFI implementation in windows 10" I didn't think this was true (i thought it was something related to CFI, but not quite), but i'll take your word for it.

munin 11y ago
pretty much! this 2013 paper added low overhead (4%?) forward and backward CFI at the binary level, tested on internet explorer and firefox: http://www.cs.berkeley.edu/~dawnsong/papers/Oakland2013-CCFIR-CR.pdf http://www.cs.berkeley.edu/~dawnsong/papers/Oakland2013-CCFI... this paper (2014) does forward CFI on chrome for 4% overhead: https://www.eecs.harvard.edu/cs261/papers/tice-2014.pdf https://www.eecs.harvard.edu/cs261/papers/tice-2014.pdf IE on windows 8.1 (including adobe flash) is compiled with forward control flow integrity: https://blog.coresecurity.com/2015/03/25/exploiting-cve-2015-0311-part-ii-bypassing-control-flow-guard-on-windows-8-1-update-3/ https://blog.coresecurity.com/2015/03/25/exploiting-cve-2015... note that the exploitation strategy CORE used leveraged JIT, few systems (with some notable exceptions like librando) acknowledge JIT in their work. so this technology is out there...