signal-sfop/sfop

Source: https://github.com/signal-sfop/sfop

Segmentation Fault-Oriented Programming (SFOP)

This is the artifacts repository for the Segmentation Fault-Oriented Programming exploitation technique.

Artifacts Collection

Here we briefly describe the artifacts in this repository. In total, there are eight different artifacts, composed of six PoC exploits and two exploits in real-world programs (Nginx and Ladybird):

• PoCs:

  • bSFOP_ek: Complete bSFOP exploit using a chain to register the signal and the Early Kill to launch the attack.
  • bSFOP_fixed: Simpler to debug bSFOP, manually registered signal and manual faulty gadget to launch the attack.
  • bSFOP_multistage: Same as bSFOP_fixed, but the whole payload is not transmited at the start, it is read in multiple parts.
  • chain: Isolated example of using a chain to register sigaction.
  • fSFOP_ek: Complete fSFOP exploit using a chain to register the signal and the Early Kill to launch the attack.
  • fSFOP_fixed: Simpler to debug fSFOP, manually registered signal and manual faulty gadget to launch the attack.

• vulnerable-nginx: a modified version of Nginx with the CVE-2013-2028 vulnerability. Showcases fSFOP with a custom signal registering chain and using the Early Kill.

• vulnerable-ladybird: a modified version of SerenityOS with the CVE-2021-4327 vulnerability. Showcases fSFOP with a custom signal registering chain and using the Early Kill.

Every file comes with its own README.

Requirements

Every PoC is dockerized. Docker is the only software requirement.

Running the PoCs requires active CET enforcement.

For this:

• Use a bare-metal machine, i.e., do not use a virtualized environtment (Virtualbox, WSL…) as CET is not enabled yet there.
• Use an Intel processor of 11th generation (Tiger Lake) or newer. AMD processors may work but were not tested.
• To be on the safe side, use a Linux kernel 6.6 or newer.

Our experiments have been tested in multiple machines, including:

• Ubuntu 24.04 with kernel 6.14 and glibc 2.39, Intel i3-14100 x86_64.