3 ms·
We can detect corruption in 15/16 times. In our tests, when we didn't detect a corruption, the program still crashed, but without a proper error message. One sh
by eyalitki 6y ago
We can detect corruption in 15/16 times. In our tests, when we didn't detect a corruption, the program still crashed, but without a proper error message. One should remember that the pointer is masked, so an attacker without the secret mask won't be able to control the reveal()ed pointer. And using a garbled pointer won't give the attacker anything useful, and most probably it will crash the target program.
- mywittyname 6y agoAre you saying the technique is effective at preventing a successful attack nearly every time, but that pointer modification are detected (thus logged) 15 out of 16 times?
- eyalitki 6y agoYes. We have 12 bits masking just the lower page, in addition to more than 10 bit above that. Chances to guess that correctly are VERY slim.