Data-Only Attacks Are Easier Than You Think
Data-only attacks, which corrupt program data without hijacking control flow, were long dismissed as too complex or application-specific to be practical. Researchers at USENIX Security 2024 present Einstein, an automated tool that generates such exploits with surprising ease by targeting syscall arguments. Their work shows that low-effort attackers can weaponize memory safety bugs to execute arbitrary code, challenging assumptions behind current defenses.
In our work, we show that these assumptions are all false: Exploitation requires neither extensive knowledge of the program semantics, nor the solving of complex data-flow constraints, nor the diversion of the control flow in a complicated (or even any) way.