  Despite numerous countermeasures proposed by practitioners and researchers,
remote control-flow alteration of programs with memory-safety vulnerabilities
continues to be a realistic threat. Guaranteeing that complex software is
completely free of memory-safety vulnerabilities is extremely expensive.
Probabilistic countermeasures that depend on random secret keys are
interesting, because they are an inexpensive way to raise the bar for attackers
who aim to exploit memory-safety vulnerabilities. Moreover, some
countermeasures even support legacy systems. However, it is unclear how to
quantify and compare the effectiveness of different probabilistic
countermeasures or combinations of such countermeasures. In this paper we
propose a methodology to rigorously derive security bounds for probabilistic
countermeasures. We argue that by representing security notions in this setting
as events in probabilistic games, similarly as done with cryptographic security
definitions, concrete and asymptotic guarantees can be obtained against
realistic attackers. These guarantees shed light on the effectiveness of single
countermeasures and their composition and allow practitioners to more precisely
gauge the risk of an attack.
