Non-Control-Data Attacks and Defenses: A Review

In recent years, non-control-data attacks have become a research hotspot in the field of network security, driven by the increasing number of defense methods against control-flow hijacking attacks. These attacks exploit memory vulnerabilities to modify non-control data within a program, thereby altering its behavior without compromising control-flow integrity. Research has shown that non-control-data attacks can be just as damaging as control-flow hijacking attacks and are even Turing complete, making them a serious security threat. However, despite being discovered long ago, the threat of non-control-data attacks has not been adequately addressed. In this review, we first classify non-control-data attacks into two categories based on their evolution: security-sensitive function attacks and data-oriented programming (DOP) attacks. Subsequently, based on the non-control-data attack model, we categorize existing defense methods into three main strategies: memory safety, data confidentiality, and data integrity protection. We then analyze recent defense techniques specifically designed for DOP attacks. Finally, we identify the key challenges hindering the widespread adoption of defenses against non-control-data attacks and explore future research directions in this field.