3 ms·
It's not [what I'm looking for], but it's a great step forward, for sure. It should reduce/eliminate the buffer overflows/use-after-frees that could be used to
by wyldfire 8y ago
It's not [what I'm looking for], but it's a great step forward, for sure. It should reduce/eliminate the buffer overflows/use-after-frees that could be used to kick off ROP, but AFAIK it doesn't eliminate the gadgets themselves.
- saagarjha 8y agoThe point of pointer authentication is to make it impossible to actually user gadgets because you would be hard-pressed to find a signed pointer that is necessary to actually jump to a arbitrary location, since you’d be missing the one that was handed out to you in the prologue had you gone the correct way through the function. I guess in a way it’s a type of CFI check. With regards to actually stopping buffer overflows or double frees, it’s not going to help much. But we have other mitigation techniques, such as stack cookies, to help in these cases.
- wyldfire 8y agoOh I confused pointer auth with the newer ARM MTE [1]. That (nearly) eliminates use-after-free/buffer-overflow. [1] https://community.arm.com/processors/b/blog/posts/arm-a-profile-architecture-2018-developments-armv85a https://community.arm.com/processors/b/blog/posts/arm-a-prof...