Mitigations for Low-level Coding Vulnerabilities: Incomparability and Limitations. http://research.microsoft.com/users/jpincus/mitigations.pdf

Exploits of vulnerabilities due to low-level coding defects such as buffer overruns and integer overflows are a major source of security problems. Mitigation techniques attempt to limit damage from these vulnerabilities. While many such techniques have been developed and deployed, work to date has proceeded in a haphazard fashion. A more structured approach to the problem requires the understanding between vulnerabilities, exploits, and mitigations. Multiple exploit techniques can apply to any individual vulnerability, and mitigations focus either on the underlying defects or directly on specific exploits. We reduce all published exploits to combinations of three primitive techniques, and provide a taxonomy of mitigation techniques. Using these taxonomies, we show that mitigation techniques are incomparable: each category prevents some exploits not addressed by other. No combination of currently-deployed mitigation techniques defeats all currently-known exploits