[wmf]

If the stack and heap are non-executable and page tables can't be modified then it's hard to inject code. Whether unikernels actually apply this hardening is another matter.

[catlifeonmars]

Isn’t this where ROP gadgets come in?

[wmf]

ASLR defeats ROP. Whether unikernels actually use ASLR is another matter.