English
Menu

What is Control-flow integrity?

A general term for defenses that keep a program's flow of execution from leaving the paths possible in the original program (its control-flow graph). It includes hardware features such as shadow stacks and pointer authentication, which protect returns from functions, and Intel IBT and Arm Branch Target Identification, which restrict the targets of indirect calls and jumps to places carrying a designated marker, as well as target checks inserted by compilers. It makes attacks that overwrite return addresses or function pointers to chain fragments of existing code harder.

Japanese name: 制御フロー完全性

Control-flow integrity appears in 1 practice question across 1 topic, including Hardware Security: Advanced Topics and Trends.

Field: Hardware Security: Advanced Topics and Trends

Try it: questions about Control-flow integrity

Regarding hardware features that support control-flow integrity, which correctly pairs what protects returns from functions with what protects indirect calls and jumps such as those through function pointers?

  1. AReturns are protected by shadow stacks or pointer authentication; indirect calls and jumps by mechanisms requiring a designated marker instruction at the start of the target
  2. BReturns are protected by mechanisms requiring a designated marker instruction at the start of the target; indirect calls and jumps by shadow stacks
  3. CReturns are protected by KPTI (kernel page-table isolation); indirect calls and jumps by address translation in the IOMMU
Show answer and explanation

Answer: A. Returns are protected by shadow stacks or pointer authentication; indirect calls and jumps by mechanisms requiring a designated marker instruction at the start of the target

A shadow stack compares the return address with its copy, and pointer authentication checks the authentication code attached to the return address, so both protect returns from functions. For indirect calls and jumps, Intel IBT and Arm Branch Target Identification require a marker instruction at the start of the target (ENDBR64 on x86) and turn branches into the middle of functions and the like into exceptions. However, any place with a marker can still be reached from any indirect branch, so these features are sometimes combined with finer checks by the compiler that restrict targets to functions of a matching type. KPTI is a countermeasure against Meltdown and the IOMMU restricts device DMA; neither protects control flow.

Questions that mention Control-flow integrity (1)

  1. Regarding hardware features that support control-flow integrity, which correctly pairs what protects returns from functions with what protects indirect calls and jumps such as those through function pointers?

Books on Hardware Security: Advanced Topics and Trends Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Function pointer Shadow stack Return address Pointer authentication (PAC) Kernel page-table isolation (KPTI) Meltdown IOMMU DMA (direct memory access) Arm CCA (Confidential Compute Architecture) CHERI

Back to the glossary