What is return-oriented attacks?

Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute arbitrary code in the presence of security defenses such as non-executable memory and code signing. In ROP, the attacker gains control of the call stack to hijack program control flow and then executes carefully chosen machine instruction sequences that are already present in the machine's memory, called 'gadgets'. Each gadget typically ends in a return instruction and is located at a fixed address. By chaining these gadgets together, an attacker can perform arbitrary operations.