Connect and corrupt: C++ coroutines prone to code-reuse attack despite CFI
cispa.de
A code-reuse attack named Coroutine Frame-Oriented Programming (CFOP) is capable of exploiting C++ coroutines across three major compilers, namely Clang/LLVM, GCC and MSVC.
  • Hirom@beehaw.org
    1·
    1 month ago

    This is a C++20 feature so most software probably aren’t using this yet.

    It’s good to catch this relatively early. Crossing fingers so that compilers can fix it without breaking compatibility.