Control Flow Integrity (CFI)

Secures indirect call and jump instructions by ensuring they target only valid function entry points. This is typically enforced through a shadow stack or by validating target addresses against a set of allowed destinations before execution. A common implementation is Microsoft's Control Flow Guard (CFG), which inserts checks before indirect calls to verify the target is a compiler-identified valid function start.

Protects return instructions from being hijacked to redirect execution to a ROP gadget. The primary mechanism is a shadow stack, a hardware- or software-maintained copy of return addresses that is compared against the actual stack before each ret instruction. Intel's CET and ARM's Pointer Authentication (PAC) provide hardware-accelerated backward-edge integrity.

CFI policies are derived from a program's static Control Flow Graph, which maps all legitimate execution paths. A coarse-grained CFI may only enforce that returns land on valid instruction boundaries, while fine-grained CFI enforces strict context-sensitivity, ensuring a call site can only return to its specific caller. LLVM's CFI sanitizers implement fine-grained checks using type-based jump tables.

Modern processors include dedicated instructions to reduce the performance overhead of software-only CFI:

• Intel CET: Introduces a hardware shadow stack and indirect branch tracking (IBT) that marks valid indirect branch targets with ENDBR64 instructions.
• ARM PAC: Uses cryptographic signatures embedded in unused pointer bits to authenticate return addresses and function pointers before use.
• AMD Shadow Stack: Provides hardware-enforced return address integrity with minimal performance impact.

Coarse-grained CFI groups targets into equivalence classes, reducing metadata size but allowing an attacker to redirect execution to any function with a compatible signature. Fine-grained CFI enforces strict per-call-site constraints, dramatically reducing the attack surface but incurring higher performance overhead. The trade-off is between security precision and runtime efficiency, with modern systems often using hybrid approaches.

CFI is not a silver bullet. Advanced attacks can bypass CFI through:

• COOP (Counterfeit Object-Oriented Programming): Exploits entire valid virtual function dispatches rather than individual gadgets.
• Data-only attacks: Corrupt non-control data to alter program logic without violating the control flow graph.
• Signal handler exploitation: Leverages asynchronous signal delivery mechanisms that may execute outside CFI enforcement boundaries. Effective defense requires combining CFI with code integrity, data execution prevention, and address space layout randomization (ASLR).

A programming language that manages memory automatically at compile time through an ownership model, eliminating entire classes of memory-safety bugs like use-after-free and buffer overflows. Languages like Rust enforce these guarantees without a garbage collector, making them ideal for systems programming. By preventing spatial and temporal memory errors at the language level, memory-safe languages reduce the attack surface that CFI is designed to mitigate, shifting security left into the development phase.

A security facility in the Linux kernel that allows a process to make a one-way transition into a restricted state where it can only make a predefined set of system calls. Once activated, any disallowed syscall triggers immediate termination. Seccomp profiles complement CFI by reducing the kernel attack surface available to an attacker who has already achieved code execution, limiting post-exploitation capabilities even if control flow is hijacked.

A revolutionary kernel technology that allows sandboxed programs to run in the Linux kernel without changing kernel source code. eBPF enables deep, high-performance observability and security enforcement for agent processes. It can be used to implement custom CFI-like policies by monitoring and validating control flow transitions in real-time at the kernel level, providing runtime enforcement without recompilation.

A security control that prevents an agent from executing any binary or script that is not on a pre-approved list. This blocks unauthorized code from running even if a tool-calling vulnerability is exploited. While CFI restricts valid code to legitimate paths, execution allowlisting ensures that only known-good executables can be invoked in the first place, creating a complementary layer of defense against code injection.

A portable, low-level bytecode format that executes in a memory-safe, capability-based sandbox. Wasm's structured control flow guarantees that jumps can only target valid locations declared ahead of time, providing a form of architectural CFI built directly into the runtime. This makes Wasm an attractive execution environment for untrusted agent code and third-party plugins.

The practice of monitoring and protecting an agent's execution environment in real-time by detecting anomalous system calls, file access patterns, and network connections that indicate a compromise. Runtime security tools can detect when CFI enforcement has failed or been bypassed by observing behavioral deviations from the expected execution baseline, serving as a last line of detection.