If I read it correctly, the attack has three steps: 1. Exploit a miscalculated pointer to write arbitrary data. 2. Exploit a ASLR infoleak to figure out the t

If I read it correctly, the attack has three steps: 1. Exploit a miscalculated pointer to write arbitrary data. 2. Exploit a ASLR infoleak to figure out the target. 3. Use (1) to create a fake timer with a callback to "system()". Can some forms of Control Flow Integrity mitigate this type of attacks? W^X is useless in this case, but if Control Flow Integrity offers code pointer target verification, it could have a chance to catch the final bogus callback, am I correct?