4 ms·

So - for those deeper into security - is this useful? "Graviton3 processors also include a new pointer authentication feature that is designed to improve secur

So - for those deeper into security - is this useful? "Graviton3 processors also include a new pointer authentication feature that is designed to improve security. Before return addresses are pushed on to the stack, they are first signed with a secret key and additional context information, including the current value of the stack pointer. When the signed addresses are popped off the stack, they are validated before being used. An exception is raised if the address is not valid, thereby blocking attacks that work by overwriting the stack contents with the address of harmful code. We are working with operating system and compiler developers to add additional support for this feature, so please get in touch if this is of interest to you"

staticassertion 5y ago
I've heard very promising things about pointer authentication.
tyingq 5y ago
It would take the heat off for mitigating buffer overflow CVEs in a rushed way. There are many of those that give remote code execution, so typically a frenzied patching exercise. A little more time to do the patching in a more deliberate way would be nice.
- staticassertion 5y ago
  I think in some cases this would effectively mitigate a vulnerability entirely. If you require control over the return address you're basically shit out of luck. A buffer overflow at that point is going to have to target some other function pointer or data, which may not be feasible in a given function.
ComputerGuru 5y ago
These slides should help: https://llvm.org/devmtg/2019-10/slides/McCall-Bougacha-arm64e.pdf https://llvm.org/devmtg/2019-10/slides/McCall-Bougacha-arm64...
- saagarjha 5y ago
  Note that those slides are slightly LLVM/Apple biased.
spijdar 5y ago
Very useful, depending on the implementation and potential trade-offs. If the performance is good, this is a nice extra layer that makes return-oriented programming more difficult. Combined with NX bits, it really raises the difficulty in developing/using many types of exploits. (it's not impossible to bypass, I'm vaguely aware it's been done on Apple's new chips that implement a similar (the same?) ARM extension, but there's no perfect security)
- pram 5y ago
  Yup arm64e in general has pointer authentication, iOS and MacOS already implement it.
  - philistine 5y ago
    It's incredible how Apple went from a laggard in new technologies to a trailblazer. I guess that's the power of a corporation on the scale of an 18th century trade monopoly.
    - pjmlp 5y ago
      Except Oracle did it first with SPARC ADI, Solaris on SPARC is one of the few UNIXes that have tamed C for couple of years now. And actually pointer tagging architectures go all the way back to the early 1960's, with Burroughs being one of the first ones having a go at it.
      - zokier 5y ago
        It's not much of trailblazing if nobody follows on the trail.
        pjmlp 5y ago
        Indeed, Apple is following the trail of Burroughs, iAPX 432, MPX, SPARC ADI, Lisp Machines, among others.
- 5y ago
deleted 5y ago
[deleted]
MaxBarraclough 5y ago
This isn't something I know a lot about but it sounds like the idea of a shadow stack [0] but implemented with crypto. See also Intel CET (for Control-flow Enforcement Technology). [1] [0] https://en.wikipedia.org/wiki/Shadow_stack https://en.wikipedia.org/wiki/Shadow_stack [1] https://www.intel.com/content/www/us/en/developer/articles/technical/technical-look-control-flow-enforcement-technology.html https://www.intel.com/content/www/us/en/developer/articles/t...
ljhsiung 5y ago
Pointer authentication has been around for several years already. As with many things in hardware, though, it takes time for the software ecosystem around it to mature. Still, I've found it to be quite influential. Here are a couple "real world" examples-- Project Zero had a blogpost about some of the weaknesses on the original Pointer Auth spec [0], and even had a follow up [1]. Here is an example of what some mitigation might look like, showing how gets(), which is a classically trivially vulnerable primitive, becomes not-so-trivial (but still feasible enough to do in a blogpost, obviously) [2]. Cost-wise, in terms of both hardware and software, it's rather cheap. The hardware to support this isn't too expensive, about on par with a multiplier. On the software end, like I said, it's taken some time to mature and gotten to a pretty good state IMO, with basically all compilers providing simple usage since 2019-- just turn on a flag! ARM also did a performance vs. ROP gadget reduction analysis [3]. The takeaway is, as others have mentioned, while it doesn't completely mitigate, it does heavily increase the complexity for rather cheap. In fact, I'm rather annoyed Amazon didn't include this feature on Graviton2, and to claim it as new or innovative on their end feels just like marketing speak. Any CPU that claims to be ARMv8.5-a compliant *must* have this feature, and that's been around for quite a few years now. [0]: https://googleprojectzero.blogspot.com/2019/02/examining-pointer-authentication-on.html https://googleprojectzero.blogspot.com/2019/02/examining-poi... [1]: https://bazad.github.io/presentations/BlackHat-USA-2020-iOS_Kernel_PAC_One_Year_Later.pdf https://bazad.github.io/presentations/BlackHat-USA-2020-iOS_... [2]: https://blog.ret2.io/2021/06/16/intro-to-pac-arm64/ https://blog.ret2.io/2021/06/16/intro-to-pac-arm64/ [3]: https://developer.arm.com/documentation/102433/0100/Applying-these-techniques-to-real-code https://developer.arm.com/documentation/102433/0100/Applying...
- my123 5y ago
  > In fact, I'm rather annoyed Amazon didn't include this feature on Graviton2 Arm-designed licensable cores didn't have it back then, and that's what AWS uses. Graviton2 used the Neoverse N1 core.
- pjmlp 5y ago
  So far, I think Solaris SPARC ADI is the more mature version of it on use, however given it is Solaris SPARC, not many are aware of it.

staticassertion 5y ago

I've heard very promising things about pointer authentication.

tyingq 5y ago

It would take the heat off for mitigating buffer overflow CVEs in a rushed way. There are many of those that give remote code execution, so typically a frenzied patching exercise. A little more time to do the patching in a more deliberate way would be nice.

staticassertion 5y ago
I think in some cases this would effectively mitigate a vulnerability entirely. If you require control over the return address you're basically shit out of luck. A buffer overflow at that point is going to have to target some other function pointer or data, which may not be feasible in a given function.

ComputerGuru 5y ago

These slides should help: https://llvm.org/devmtg/2019-10/slides/McCall-Bougacha-arm64e.pdf https://llvm.org/devmtg/2019-10/slides/McCall-Bougacha-arm64...

saagarjha 5y ago
Note that those slides are slightly LLVM/Apple biased.

spijdar 5y ago

Very useful, depending on the implementation and potential trade-offs. If the performance is good, this is a nice extra layer that makes return-oriented programming more difficult. Combined with NX bits, it really raises the difficulty in developing/using many types of exploits. (it's not impossible to bypass, I'm vaguely aware it's been done on Apple's new chips that implement a similar (the same?) ARM extension, but there's no perfect security)

pram 5y ago
Yup arm64e in general has pointer authentication, iOS and MacOS already implement it.
- philistine 5y ago
  It's incredible how Apple went from a laggard in new technologies to a trailblazer. I guess that's the power of a corporation on the scale of an 18th century trade monopoly.
  - pjmlp 5y ago
    Except Oracle did it first with SPARC ADI, Solaris on SPARC is one of the few UNIXes that have tamed C for couple of years now. And actually pointer tagging architectures go all the way back to the early 1960's, with Burroughs being one of the first ones having a go at it.
    - zokier 5y ago
      It's not much of trailblazing if nobody follows on the trail.
      - pjmlp 5y ago
        Indeed, Apple is following the trail of Burroughs, iAPX 432, MPX, SPARC ADI, Lisp Machines, among others.
5y ago

deleted 5y ago

[deleted]

MaxBarraclough 5y ago

This isn't something I know a lot about but it sounds like the idea of a shadow stack [0] but implemented with crypto. See also Intel CET (for Control-flow Enforcement Technology). [1] [0] https://en.wikipedia.org/wiki/Shadow_stack https://en.wikipedia.org/wiki/Shadow_stack [1] https://www.intel.com/content/www/us/en/developer/articles/technical/technical-look-control-flow-enforcement-technology.html https://www.intel.com/content/www/us/en/developer/articles/t...

ljhsiung 5y ago

Pointer authentication has been around for several years already. As with many things in hardware, though, it takes time for the software ecosystem around it to mature. Still, I've found it to be quite influential. Here are a couple "real world" examples-- Project Zero had a blogpost about some of the weaknesses on the original Pointer Auth spec [0], and even had a follow up [1]. Here is an example of what some mitigation might look like, showing how gets(), which is a classically trivially vulnerable primitive, becomes not-so-trivial (but still feasible enough to do in a blogpost, obviously) [2]. Cost-wise, in terms of both hardware and software, it's rather cheap. The hardware to support this isn't too expensive, about on par with a multiplier. On the software end, like I said, it's taken some time to mature and gotten to a pretty good state IMO, with basically all compilers providing simple usage since 2019-- just turn on a flag! ARM also did a performance vs. ROP gadget reduction analysis [3]. The takeaway is, as others have mentioned, while it doesn't completely mitigate, it does heavily increase the complexity for rather cheap. In fact, I'm rather annoyed Amazon didn't include this feature on Graviton2, and to claim it as new or innovative on their end feels just like marketing speak. Any CPU that claims to be ARMv8.5-a compliant *must* have this feature, and that's been around for quite a few years now. [0]: https://googleprojectzero.blogspot.com/2019/02/examining-pointer-authentication-on.html https://googleprojectzero.blogspot.com/2019/02/examining-poi... [1]: https://bazad.github.io/presentations/BlackHat-USA-2020-iOS_Kernel_PAC_One_Year_Later.pdf https://bazad.github.io/presentations/BlackHat-USA-2020-iOS_... [2]: https://blog.ret2.io/2021/06/16/intro-to-pac-arm64/ https://blog.ret2.io/2021/06/16/intro-to-pac-arm64/ [3]: https://developer.arm.com/documentation/102433/0100/Applying-these-techniques-to-real-code https://developer.arm.com/documentation/102433/0100/Applying...

my123 5y ago
> In fact, I'm rather annoyed Amazon didn't include this feature on Graviton2 Arm-designed licensable cores didn't have it back then, and that's what AWS uses. Graviton2 used the Neoverse N1 core.
pjmlp 5y ago
So far, I think Solaris SPARC ADI is the more mature version of it on use, however given it is Solaris SPARC, not many are aware of it.