Data-Only Attacks Are Easier than You Think, USENIX Tool Shows

A tool built by the VUSec group at Vrije Universiteit Amsterdam automatically generates so-called data-only attacks — exploits that never divert a program's control flow — far more easily than the security field has long assumed. The results appear in the USENIX ;login: article "Data-Only Attacks Are Easier than You Think" (July 1, 2024).

What a data-only attack is

Classic exploits hijack control flow by overwriting a code pointer, a route that DEP, CFI and CPI have since made very hard. Data-only attacks instead let the program execute every function and system call it intended to, but with malicious data, so only the arguments change.

Rewriting a server's CGI-BIN path

The example is a web server whose cgi_bin_path variable points to "/usr/local/server/cgi-bin". A memory safety bug — the kind Microsoft, Google and Mozilla say accounts for about 70% of their security bugs — lets a malicious client overflow a buffer and rewrite that path to "/bin". The attacker's "POST /sh" request with "touch /tmp/attacker-was-here" then makes the server concatenate the two into "/bin/sh": execve runs the shell and the file is created. The victim runs no attacker code — only the syscall arguments differ.

Einstein and the numbers

The pipeline is named Einstein, after the quote attributed to Albert Einstein. It targets syscalls, the universal interface to the kernel, and uses dynamic taint analysis to track which attacker-corruptible values reach arguments of security-sensitive syscalls such as execve or write; candidates come from "identity data flows", arguments that are verbatim copies of attacker-controllable data. The results: 1,834 such syscalls with tainted arguments in httpd, 1,623 in nginx, 2,105 in postgres, 218 in redis and 92 in lighttpd — and, apart from postgres, 82–98% had an identity data flow. Test suites with only 27–49% code coverage sufficed, and for nginx alone Einstein confirmed 944 exploits, two bypassing state-of-the-art mitigations.

Why defenders should care

Data-only attacks break an assumption behind today's mitigations. Control-flow hijacking had a well-defined target — a code pointer feeding an indirect branch — so DEP, CFI and CPI could be both comprehensive and practical. Because data-only attacks can corrupt any data, the authors argue defences can generally be only one or the other: full memory safety or data-flow integrity cost performance, while practical measures such as syscall filtering are incomplete.