3 ms·
Hmm, doesn't ARM have mitigation against Return oriented Programming
by keepquestioning 4y ago
Hmm, doesn't ARM have mitigation against Return oriented Programming
- pmalynin 4y agoYeah some devices support PAC use that feature to sign return pointers. But not everyone uses it (even when available), and there exist methods to bypass PAC— from attacking the micro architecture to finding signing oracles.
- muricula 4y agoPAC (pointer signing) & Branch Target Identification are not available on 32 bit arm chips, and judging by the assembly in the blog post the Titan M is a 32 bit chip.
- saagarjha 4y agoThere's a new PAC specification for ARMv8-M: https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/armv8-1-m-pointer-authentication-and-branch-target-identification-extension https://community.arm.com/arm-community-blogs/b/architecture...
- wyldfire 4y agoThere's multiple mitigations, including some compiler passes IIRC. But the pointer auth hardware ones defined by ARM were probably specified after Titan M's original design.