Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: Bypassing memory safety mechanisms through speculative control flow
  hijacks   The prevalence of memory corruption bugs in the past decades resulted in
numerous defenses, such as stack canaries, control flow integrity (CFI), and
memory safe languages. These defenses can prevent entire classes of
vulnerabilities, and help increase the security posture of a program. In this
paper, we show that memory corruption defenses can be bypassed using
speculative execution attacks. We study the cases of stack protectors, CFI, and
bounds checks in Go, demonstrating under which conditions they can be bypassed
by a form of speculative control flow hijack, relying on speculative or
architectural overwrites of control flow data. Information is leaked by
redirecting the speculative control flow of the victim to a gadget accessing
secret data and acting as a side channel send. We also demonstrate, for the
first time, that this can be achieved by stitching together multiple gadgets,
in a speculative return-oriented programming attack. We discuss and implement
software mitigations, showing moderate performance impact.

31
The categories of this paper are: ao-sci
35
The categories of this paper are: mtrl-th
20
The categories of this paper are: acc-phys
21
The categories of this paper are: adap-org
15
The categories of this paper are: nucl-ex
23
The categories of this paper are: solv-int
3
The categories of this paper are: physics
27
The categories of this paper are: comp-gas
12
The categories of this paper are: nucl-th
7
The categories of this paper are: hep-th
29
The categories of this paper are: funct-an
30
The categories of this paper are: q-alg
2
The categories of this paper are: math
18
The categories of this paper are: econ
14
The categories of this paper are: math-ph
16
The categories of this paper are: stat