Data-Only Attacks Are Easier Than You Think

Automated excerpt

In particular, Einstein automatically generates exploits for the security-sensitive syscalls along a program’s (already valid) runtime path, and whose arguments are (simply) copied verbatim from attacker-controllable data. To generate candidate exploits, Einstein tracks all attacker-corruptible data at runtime, determining which can influence the arguments of security-sensitive syscalls. We refer to this kind of (very) straightforward data flow as an identity data flow.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.