⬇ Download holy card: ·
Blessed WarpAttack, Who Bent the Compilers' Time
Patron of jump tables, checks done once and read twice, and Control-Flow Integrity taken too literally.
Life
At IEEE Security & Privacy 2023, researchers from HexHive at EPFL, with Mathias Payer, presented WarpAttack. They showed that compilers, when optimising switch statements, sometimes read the same value twice: once to check it and once to use it. In that moment of distraction an attacker could swap it and divert the program, even with Control-Flow Integrity switched on.
Prayer
O Blessed WarpAttack, who dwells in the instant between check and use, let our compilers read once and remember what they read. Amen.
How to celebrate
Celebrated by updating the compiler and repeating at bedtime: check what you use, use what you checked.
Read it twice, and the second time it says something else.