Towards Deployable VCFI: Architectural Analysis and Cache-Optimized Verification
VTable Control-Flow Integrity (VCFI) offers fine-grained protection against control-flow hijacking attacks, but its deployment is still hindered by extensibility and performance challenges. To address these issues, we analyze existing VCFI architectures and categorize them into two paradigms, each with distinct limitations. Among these, the distributed paradigm exhibits greater potential for real-world adoption, as it naturally supports multimodule and multithreading, and can be determined at compile time. However, it is vulnerable to a single-point-of-failure weakness due to reliance on a centralized fall-through verification dispatcher and suffers from performance bottlenecks in cross-module virtual call (VCall) verification.To overcome these limitations, we introduce boundary checks that enable early triaging, distinguishing between intra-module and cross-module VCalls at the callsites, and directing them along separate verification paths. Additionally, we present a cache-optimized architecture designed to accelerate cross-module VCall verification. Inspired by SwissTable hashing, our caching mechanism utilizes a compact metadata layout and SIMD-assisted parallel probing, significantly improving the efficiency of VCall signature verification. Evaluation on SPEC CPU2006 C++ benchmarks shows that our optimizations reduce the average runtime overhead by 50% and cut the worst-case overhead to one-third. By mitigating this deployment fragility and the performance barrier inherent in the distributed paradigm, our work advances the deployability of VCFI.