Exploit Methods/Userspace execution
Once an attacker has gain control over the instruction pointers, it must be aimed somewhere. The place where attackers have the most control over memory layout tends to be in userspace, so it has been natural to place malicious code in userspace and have the kernel redirection execution there.
- hardware segmentation: SMEP (x86), PXN (arm)
- compiler instrumentation to set high bit on function calls
- emulate memory segmentation via separate page tables (e.g. PAX_MEMORY_UDEREF)