VED 2026: AFTER CFI - DATA ONLY

Summary from the TLDR InfoSec newsletter

Modern kernel privilege escalation attacks have shifted from traditional control flow methods like ROP to more stealthy, stable data-only attacks that bypass Control Flow Integrity (CFI), prompting the development of advanced defense systems like VED (Vault Exploit Defense). Novel techniques, such as DirtyPipe, cred-jar heap spray, and pipe primitives, exploit weaknesses in kernel memory handling to corrupt authentication data or page buffers, directly overwriting critical structures, including credential jars and pipe buffers, while evading detection by typical CFI solutions. VED counters these threats through multiple integrity measures, including shadow data tracking, hash monitoring, slab poisoning, and specialized protections for core patterns and pipe buffers, aiming to detect stealthy modifications and strengthen kernel security against increasingly sophisticated data-centric exploits while minimizing performance impact.