TID-206 PUBLISHED

While the use of memory permissions, such as non-executable stack and heap memory, can prevent threat actors from injecting and executing malicious code, it is still possible to leverage a process’s existing code to perform a malicious function. For example, Return Oriented Programming (ROP) is a technique used by threat actors where once a process’s stack can be overwritten, a series of “returns” to portions of code within the process can be leveraged to cause an intended malicious function. This can include “returns” to existing libraries (e.g., libc), or other instruction sequences already in memory of that process. The exploitation of this threat may be possible through TID-219, and may also be enabled by the exploitation of TID-219.

Timeline

Open in Interactive Console →