Connect and corrupt: C++ coroutines prone to code-reuse attack despite CFI
cispa.de
A code-reuse attack named Coroutine Frame-Oriented Programming (CFOP) is capable of exploiting C++ coroutines across three major compilers, namely Clang/LLVM, GCC and MSVC.
  • Hirom@beehaw.org
    11·
    5 months ago

    This is a C++20 feature so most software probably aren’t using this yet.

    It’s good to catch this relatively early. Crossing fingers so that compilers can fix it without breaking compatibility.

    • bitcrafter@programming.dev
      2·
      5 months ago

      It is pretty sad that a feature that was introduced into C++ five years ago would not be widely used yet, but that also would not surprise me.

      • TehPers@beehaw.orgEnglish
        2·
        5 months ago

        The same holds true for C++20’s modules, which are really cool! Except you can’t really use them because compilers don’t fully support them yet.