Data-Only Attacks Are Easier Than You Think

Data-only attacks corrupt program data rather than changing control flow, letting benign code run with malicious inputs to perform harmful actions. A classic example overwrites a server’s CGI_BIN_PATH so a later EXECVE syscall runs /bin/sh and executes attacker-supplied commands; the victim never executes injected code, only manipulated syscall arguments. Such attacks were long considered niche because they seemed to require deep application-specific knowledge or heavy analysis to solve complex data-flow constraints. That view is incorrect: exploitation often needs neither intimate semantic understanding nor control-flow hijacking, because many programs directly copy attacker-controllable bytes into security-sensitive syscall arguments (EXECVE, WRITE, etc.).

Researchers built Einstein, an automated, scalable pipeline that finds and verifies data-only exploits by instrumenting binaries and performing dynamic taint analysis. Einstein taints all memory an attacker could corrupt, runs realistic workloads to observe taint propagation into syscall arguments, generates candidate exploits when tainted data reaches sensitive syscalls, and then confirms working exploits. By targeting syscalls (a universal, application-agnostic interface) and focusing on straightforward copy patterns, Einstein produces large numbers of practical exploits with minimal effort. The findings show defenses that only protect control flow are insufficient and call for mitigations that ensure integrity of syscall arguments and other data-oriented protections.