SECURITY Signal 404
Crashing Through Defenses: Exploiting Segfaults and Chaining around Intel CET
A research paper demonstrates a technique that uses segmentation faults to evade Intel Control-Flow Enforcement Technology (CET).
Intel CET is a hardware-based mitigation that many modern systems rely on to stop control-flow hijacking. If attackers can chain segfaults to bypass CET, existing protection assumptions become invalid and software that only depends on CET may remain vulnerable. Engineers will need to reassess threat models and possibly add complementary defenses.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The paper describes exploiting segfaults as a way to subvert Intel CET's control-flow checks.
The attack chains multiple fault events to maintain execution after CET would normally halt the process.
The research is distributed as a PDF in a public repository, indicating it is openly available for review.
THE READ
What the cluster adds up to.
The core change introduced by the paper is a concrete method for breaking through Intel CET, a hardware feature designed to enforce valid control-flow transfers. By deliberately causing segmentation faults and then chaining execution across them, the authors claim to keep the program running despite CET's enforcement. This reveals a gap in CET's coverage of fault handling paths that had not been publicly demonstrated before. Implementing mitigations against this technique will likely require developers to add additional runtime checks around fault handlers, harden exception handling code, or employ complementary software-based control-flow integrity solutions. The cost is extra engineering effort to audit fault-related code paths and possibly performance overhead from added checks. Existing codebases that rely solely on CET without reviewing their fault handling logic may remain exposed. The approach is expected to be effective only on platforms where Intel CET is enabled and where the operating system propagates segfaults in a way that can be chained. Systems without CET, or those that already employ stricter fault isolation (e.g., sandboxed processes or custom signal ha
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER