Quantum ROP: Using Quantum Algorithms for ROP Chain Selection in Exploit Construction
Researchers apply QAOA on IBM Heron hardware to select ROP chains that escalate Linux privileges.
The paper formulates Return-Oriented Programming gadget selection as a QUBO problem that accounts for gadget cost and register-clobber interactions, then solves it with QAOA on IBM Heron r2 hardware. In a Linux kernel scenario, the selected chain reached uid 0 while SMEP and SMAP were enabled. Across eight Linux binaries and 16 benchmarks, QAOA recovered the lowest-cost valid chain in 11 cases; the other five missed the optimum because of circuit-depth limits.
- Gadget selection is cast as QUBO and solved with QAOA.
- Selected chain reached uid 0 with SMEP and SMAP active.
- Lowest-cost valid chain found in 11 of 16 instances.
- Five failures tied to excessive circuit depth on IBM hardware.
Full article146 words · extracted from arxiv.org · click to collapse
The quantum computing threat to cybersecurity is nowadays predominantly framed around Shor's algorithm and its eventual capacity to break asymmetric cryptography. Beyond cryptanalysis, however, quantum computing may also enable other capabilities in offensive security. This work explores one such direction: the application of quantum combinatorial optimization to Return-Oriented Programming (ROP) gadget selection for exploit construction. We formulate gadget selection as a Quadratic Unconstrained Binary Optimization (QUBO) problem that captures individual gadget cost and inter-gadget register-clobbering interactions, and solve it using QAOA on real IBM Heron r2 hardware. Applied to a Linux kernel exploitation scenario, the QAOA-selected chain achieves privilege escalation to uid=0 with SMEP and SMAP active. Across eight Linux binaries and 16 benchmark instances, QAOA recovered the lowest-cost valid chain in 11 cases; in the remaining five, it did not recover the optimum, with the failures associated with excessive circuit depth on current limited hardware.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.25364