Glossary
Sigreturn-oriented programming (SROP)
A code-reuse technique that forges a signal frame so the sigreturn syscall restores every CPU register from attacker-controlled data at once.
Sigreturn-oriented programming (SROP) abuses the kernel's signal-restore path. When a signal handler returns, the rt_sigreturn syscall restores the entire CPU state from a sigcontext frame on the stack — and the kernel does not verify the frame is genuine. An attacker who can place a forged frame and set rax to the sigreturn number (15 on x86-64) before a syscall instruction gains control of every register at once, including rip and rsp.
SROP needs far fewer building blocks than a full ROP chain — just a syscall and a way to set rax — so it shines when gadgets are scarce. It is contained by seccomp (denying the target syscall) and by shadow stacks that reject the hijacked return. See the SROP walkthrough.