2 ms·
For more context, CET and friends don't actually act as a ROP mitigation in it of themselves. CET is a coarse forward edge CFI technique. For completeness, you
by sweetjuly 3y ago
For more context, CET and friends don't actually act as a ROP mitigation in it of themselves. CET is a coarse forward edge CFI technique. For completeness, you must pair it with both some software function type assert (prevent argument type confusion by swapping function pointers, etc.) as well as a backwards edge CFI mitigation (such as secure a shadow stack for storing link addresses). Both are quite hard problems.
ARM's Pointer Authentication extension is an interesting alternative which does all of this in one feature by cryptographically signing pointers in memory.
- admax88qqq 3y agoJesus. The amount of engineering that has to happen to protect against C is astounding.
- wahern 3y agoProtecting JIT-compiled code, e.g. within browsers, is at least as important a concern. Some would argue much more important, especially as usage of services like Cloudflare Workers increases. Techniques like CHERI could replace MMUs in some environments, potentially improving performance.
- admax88qqq 3y agoThere's no way to express an out of bounds memory read/write in JavaScript. So you don't actually need an MMU, or CHERI, or pointer signing, or any of the stack smashing mitigations put in place for C. You do have to generate correct code but that's actually a solvable problem, web assembly did it. In theory this could unlock tons of performance (and free up some silicon) if we could ever get the rest of the system away from C
- deleted 3y ago[deleted]
- dwattttt 3y agoCET is both Indirect Branch Tracking and Shadow Stacks; IBT is the coarse towards CFI, but SSs are a direct ROP mitigation, but enforcing that any address returned to must have been CALL'd from.