Exploit mitigation may be all that stops a vulnerability being successfully exploited.

Here are some excellent slides on exploit mitigation in general: https://events.yandex.com/events/ruBSD/2013/talks/103/

Of the top of my head there are four approaches to stopping memory vulnerabilities:

1) have no bugs, e.g. formal verification etc

2) use a memory-safe language

3) accept that there can be vulnerabilities, and use exploit mitigation to harden it

4) capability-based addressing as a mitigation (it doesn't solve use-after-free, for example; it relies on software to do that etc)

Of these, (3) is the one you can retrofit to existing C/C++ codebases... a route you are usually forced to travel.

(There may still be other kinds of bugs, e.g. the obvious sql injections etc; I am talking above about memory bugs specifically)

Yeah, makes sense. Thanks for the link.

Security through obscurity can be very useful. It just shouldn't be the only thing you rely on to secure your systems.

Totally agree. I just don't know too much about kernel security and wanted to clarify whether this was mitigation via stc or something else.