  Data-oriented attacks manipulate non-control data to alter a program's benign
behavior without violating its control-flow integrity. It has been shown that
such attacks can cause significant damage even in the presence of control-flow
defense mechanisms. However, these threats have not been adequately addressed.
In this SoK paper, we first map data-oriented exploits, including Data-Oriented
Programming (DOP) attacks, to their assumptions/requirements and attack
capabilities. We also compare known defenses against these attacks, in terms of
approach, detection capabilities, overhead, and compatibility. Then, we
experimentally assess the feasibility of a detection approach that is based on
the Intel Processor Trace (PT) technology. PT only traces control flows, thus,
is generally believed to be not useful for data-oriented security. However, our
work reveals that data-oriented attacks (in particular the recent DOP attacks)
may generate side-effects on control-flow behavior in multiple dimensions,
which manifest in PT traces. Based on this evaluation, we discuss challenges
for building deployable data-oriented defenses and open research questions.
