If I understand aright, the concern here is that if one finds some form of way to corrupt memory, then one could use that to corrupt memory in the program to cause the program to jump to some other code used in a coroutine in much the same way that a buffer overflow in code modifying a variable stored on the stack could permit an attacker one to overwrite a return address on a stack to jump to arbitrary code.
this post was submitted on 05 Aug 2025
38 points (100.0% liked)
Programming
22034 readers
349 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 2 years ago
MODERATORS
It seems like the more interesting thing is bypassing CFI protections by abusing coroutines to jump around instead of inserting jumps to other functions.
This is a C++20 feature so most software probably aren't using this yet.
It's good to catch this relatively early. Crossing fingers so that compilers can fix it without breaking compatibility.
It is pretty sad that a feature that was introduced into C++ five years ago would not be widely used yet, but that also would not surprise me.
The same holds true for C++20's modules, which are really cool! Except you can't really use them because compilers don't fully support them yet.