A recent analysis published in USENIX Login:Online in February 2024 has shed critical light on a class of exploits known as data-only attacks (DOAs), demonstrating their increasing practicality and ability to bypass contemporary security mitigations. The research, which introduced a novel tool called DOPA (Data-Only Pointer Analysis), revealed several significant vulnerabilities in the Linux kernel, including CVE-2020-27170, CVE-2020-27171, and CVE-2021-38160. These findings underscore a growing threat landscape where sophisticated adversaries can achieve privilege escalation not by hijacking program control flow, but by subtly manipulating critical data structures in memory, posing a profound challenge to established defense strategies.
The Resurgence of Data-Only Attacks
For decades, the concept of data-only attacks has existed largely in theoretical discussions, overshadowed by more prevalent control-flow hijacking techniques like Return-Oriented Programming (ROP) or Jump-Oriented Programming (JOP). These traditional methods rely on redirecting a program's execution pointer to malicious code or gadget chains. However, as operating systems and compilers have integrated robust defenses such as Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP/NX), and Control-Flow Integrity (CFI), directly manipulating control flow has become significantly harder.
The 2024 USENIX publication contends that these very defenses have inadvertently made data-only attacks a more viable and, perhaps, "easier" path for skilled attackers. A data-only attack achieves its malicious objective by altering only data values in memory, without ever changing a code pointer or rerouting program execution. This allows the exploit to circumvent the core mechanisms of ASLR (which randomizes code addresses), DEP/NX (which prevents execution from data segments), and CFI (which verifies legitimate control flow transfers).
The breakthrough presented in the research is the DOPA tool, which automates the discovery of these elusive vulnerabilities. DOPA systematically analyzes kernel code to identify potential data-only attack primitives, specifically looking for ways that an attacker can manipulate data to achieve a desired state, such as gaining root privileges. This analytical capability is what has moved DOAs from theoretical musings to practical, demonstrable threats.
Specifics: CVEs and Kernel Impact
The DOPA tool proved its efficacy by uncovering several critical vulnerabilities within the Linux kernel, affecting versions ranging from 4.14 to 5.10. These were not theoretical constructs but concrete security flaws that could lead to severe compromise.
Among the most significant findings were:
- CVE-2020-27170 and CVE-2020-27171: These vulnerabilities were identified in the
nf_tablescomponent of the Netfilter firewall module within the Linux kernel. Both allowed an unprivileged local user to achieve root privileges through data-only manipulation. Specifically, attackers could alter critical kernel data structures related to user credentials or permissions, effectively elevating their access rights without executing any unauthorized code. - **CVE-2021-38
Check your own site
Reading about these risks is one thing; knowing whether your own website is exposed is another. Run a free security scan with ScanLabs AI to check your site for the issues covered here and get a clear, prioritised report of what to fix.
Source: usenix.org — this analysis is based on reporting from usenix.org.
Related reading
- Shifting Sands: GitHub's 2FA Mandate and the Looming Software Supply Chain Reckoning
- The Invisible Threat: Sycophantic AI Undermines Prosocial Behavior and Fosters Dangerous Dependence
- Read the Docs Hit by Disruptive September 2026 DDoS Attack, Highlighting Open-Source Infrastructure Vulnerabilities
