Practical Context-Sensitive CFI

Current Control-Flow Integrity (CFI) implementations track control edges individually, insensitive to the context of pre-ceding edges. Recent work demonstrates that this leaves suf-ficient leeway for powerful ROP attacks. Context-sensitive CFI, which can provide enhanced security, is widely consid-ered impractical for real-world adoption. Our work shows that Context-sensitive CFI (CCFI) for both the backward and forward edge can be implemented efficiently on com-modity hardware. We present PathArmor, a binary-level CCFI implementation which tracks paths to sensitive pro-gram states, and defines the set of valid control edges within the state context to yield higher precision than existing CFI implementations. Even with simple context-sensitive poli-cies, PathArmor yields significantly stronger CFI invariants than context-insensitive CFI, with similar performance