Quantum algorithms improve selection of code pieces for computer exploits
Quantum ROP: Using Quantum Algorithms for ROP Chain Selection in Exploit Construction
Cryptography and Security
Summary
Building computer exploits often involves choosing a sequence of code snippets called gadgets. The authors show how quantum computing can help pick better sequences by turning this selection into a puzzle a quantum algorithm can solve. They tested this approach on real quantum hardware in attacks on Linux systems with certain security features active. They found the quantum method often picked the best chain but sometimes struggled due to current hardware limitations.
What this means in practice
- •For offensive security teams: Use quantum algorithms to select optimal ROP gadget chains for constructing exploits that bypass Linux kernel protections like SMEP and SMAP.
- •For quantum algorithm developers: Test and improve quantum combinatorial optimization techniques on real hardware using security-related gadget selection problems as benchmarks.
Authors
Carlos Benitez
Abstract
The quantum computing threat to cybersecurity is nowadays predominantly framed around Shor's algorithm and its eventual capacity to break asymmetric cryptography. Beyond cryptanalysis, however, quantum computing may also enable other capabilities in offensive security. This work explores one such direction: the application of quantum combinatorial optimization to Return-Oriented Programming (ROP) gadget selection for exploit construction. We formulate gadget selection as a Quadratic Unconstrained Binary Optimization (QUBO) problem that captures individual gadget cost and inter-gadget register-clobbering interactions, and solve it using QAOA on real IBM Heron r2 hardware. Applied to a Linux kernel exploitation scenario, the QAOA-selected chain achieves privilege escalation to uid=0 with SMEP and SMAP active. Across eight Linux binaries and 16 benchmark instances, QAOA recovered the lowest-cost valid chain in 11 cases; in the remaining five, it did not recover the optimum, with the failures associated with excessive circuit depth on current limited hardware.