Glossary

Plain-language definitions of the memory-safety, exploitation and mitigation terms used across the guides.

AddressSanitizer (ASan): A compiler instrumentation and runtime that detects out-of-bounds accesses, use-after-free and double free at the exact faulting instruction.
ASLR: Address Space Layout Randomization: the operating system places the stack, heap, libraries and executable at random addresses on each run.
Branch target identification (BTI): An ARMv8.5 feature that forces indirect branches to land on a bti landing-pad instruction, invalidating mid-function gadgets on the forward edge.
Control Flow Guard (CFG): A Windows forward-edge mitigation that checks every indirect call against a bitmap of valid targets, blocking jumps into the middle of functions or into data.
Control-flow integrity (CFI): A family of mitigations that check at runtime that indirect calls, jumps and returns go only to targets the program could legitimately reach.
Double free: Freeing the same heap allocation twice, which corrupts allocator free lists and can lead to memory corruption (CWE-415).
File-structure attacks (FSOP): Corrupting a glibc FILE object so a normal stdio call dispatches through an attacker-controlled vtable pointer into chosen code.
Format-string vulnerability: A bug where untrusted input is passed as the format argument of printf-style functions, letting it read or write memory through conversion specifiers (CWE-134).
Fuzzing: Automated testing that feeds a program large numbers of generated inputs to find crashes; coverage-guided fuzzers evolve inputs that reach new code.
Global Offset Table (GOT): The table of resolved runtime addresses for imported functions; writable under lazy binding, which makes it a target for redirecting calls.
Integer overflow: An arithmetic result that exceeds the range of its integer type and wraps or triggers undefined behaviour, often producing undersized buffers (CWE-190).
KASLR (kernel ASLR): Kernel Address Space Layout Randomization loads the kernel image at a random base each boot, so kernel function and gadget addresses are unknown to an attacker.
KPTI (kernel page-table isolation): A Linux mitigation that gives user and kernel modes separate page tables, unmapping the kernel while userspace runs; introduced to mitigate Meltdown.
Link register (x30 / lr): The AArch64 register that holds the return address; bl writes it and ret branches to it, so the return address is not on the stack by default.
Memory safety: The property that a program only accesses memory within the bounds and lifetime of valid objects, ruling out overflows, use-after-free and double free.
NX bit (DEP): A page-level permission that marks memory as non-executable, so data written to the stack or heap cannot run as code. Known as DEP on Windows.
PIE (position-independent executable): An executable compiled so it can run at any address, letting ASLR randomize the program's own code and data, not only its libraries.
Pointer authentication (PAC): An ARMv8.3 feature that signs pointers with a secret key so a tampered pointer, such as an overwritten return address, fails authentication and faults.
RELRO: Relocation Read-Only: a linker and loader feature that makes the GOT and other relocation data read-only after startup, so they cannot be overwritten.
Return-oriented programming (ROP): A code-reuse technique that chains short existing instruction sequences ending in return instructions, used to work around non-executable memory.
Return-to-libc (ret2libc): A code-reuse attack that redirects execution into an existing C library function, such as system(), instead of injecting new code.
Shadow stack: A separate, protected stack that stores only return addresses, so a return is allowed only if it matches the address saved at call time.
Sigreturn-oriented programming (SROP): A code-reuse technique that forges a signal frame so the sigreturn syscall restores every CPU register from attacker-controlled data at once.
SMEP and SMAP: CPU features that stop the kernel from executing (SMEP) or accessing (SMAP) user-space memory, breaking the classic ret2usr kernel-exploitation technique.
Stack canary: A secret value placed between a function's local buffers and its saved return data, checked before the function returns to detect stack buffer overflows.
Structured Exception Handling (SEH): Windows' exception-handling mechanism; on 32-bit x86 it is a linked list of handler records on the stack, which a stack overflow can overwrite to hijack control.
tcache (thread cache): A per-thread cache of freed heap chunks in glibc 2.26+ that speeds small allocations, and a common target of heap-exploitation techniques.
Use-after-free: A memory-safety bug where a program keeps using a pointer after the memory it points to has been freed, often leading to type confusion (CWE-416).