Pointer authentication has been around for several years already. As with many things in hardware, though, it takes time for the software ecosystem around it to

Pointer authentication has been around for several years already. As with many things in hardware, though, it takes time for the software ecosystem around it to mature. Still, I've found it to be quite influential. Here are a couple "real world" examples-- Project Zero had a blogpost about some of the weaknesses on the original Pointer Auth spec [0], and even had a follow up [1]. Here is an example of what some mitigation might look like, showing how gets(), which is a classically trivially vulnerable primitive, becomes not-so-trivial (but still feasible enough to do in a blogpost, obviously) [2]. Cost-wise, in terms of both hardware and software, it's rather cheap. The hardware to support this isn't too expensive, about on par with a multiplier. On the software end, like I said, it's taken some time to mature and gotten to a pretty good state IMO, with basically all compilers providing simple usage since 2019-- just turn on a flag! ARM also did a performance vs. ROP gadget reduction analysis [3]. The takeaway is, as others have mentioned, while it doesn't completely mitigate, it does heavily increase the complexity for rather cheap. In fact, I'm rather annoyed Amazon didn't include this feature on Graviton2, and to claim it as new or innovative on their end feels just like marketing speak. Any CPU that claims to be ARMv8.5-a compliant *must* have this feature, and that's been around for quite a few years now. [0]: https://googleprojectzero.blogspot.com/2019/02/examining-pointer-authentication-on.html https://googleprojectzero.blogspot.com/2019/02/examining-poi... [1]: https://bazad.github.io/presentations/BlackHat-USA-2020-iOS_Kernel_PAC_One_Year_Later.pdf https://bazad.github.io/presentations/BlackHat-USA-2020-iOS_... [2]: https://blog.ret2.io/2021/06/16/intro-to-pac-arm64/ https://blog.ret2.io/2021/06/16/intro-to-pac-arm64/ [3]: https://developer.arm.com/documentation/102433/0100/Applying-these-techniques-to-real-code https://developer.arm.com/documentation/102433/0100/Applying...