4 ms·
The instructions have to be trap instructions for it to work. The conditional branch-backward instruction it is is almost as bad as the series of NOPs, since i
by colanderman 1y ago
The instructions have to be trap instructions for it to work.
The conditional branch-backward instruction it is is almost as bad as the series of NOPs, since it is still likely to redirect an attacker to functioning code. (If the attacker can clear the mi flag first, these are just NOPs!)
Hence yes, this is a broken exploit mitigation.
- JdeBP 1y agoAnd this is where the OpenBSD people will paraphrase Henry Spencer and say that those who do not understand OpenBSD are doomed to reinvent it badly. (Personally, I think that that's putting OpenBSD onto a pedestal. It's no ideal; one gets the same tradeoffs and problems as everywhere else.) In this case, the reinvention for LLVM targetting ARM, that credits seeing this committed to OpenBSD by Theo de Raadt, totally ignored that the original for gas targetting x86 both trapped and jumped. I intentionally also pointed you to a collection of several critiques of the whole idea, long-since made. (-:
- tourist2d 1y ago[dead]
- deleted 1y ago[deleted]
- colanderman 1y agoWhy, in your own words, is the jump supposed to be there? (Keep in mind this code is in between two functions.) And why, in your own words, is it OK for the jump to be a conditional backwards jump?
- Dylan16807 1y agoSo now you're saying this is a bad reinvention? Your first comment says "it's intentional that it works this way".
- ajross 1y agoI think you're misunderstanding. 32 bit ARM has TWO instruction encodings. OpenBSD apparently only knows about one. In thumb encoding, the instruction is a branch, not a trap.
- Someone 1y agoIt can’t be a trap in regular ARM assembly, either, can it? There, all instructions are 32 bits and D4D4 is only 16 bits.
- deleted 1y ago[deleted]
- ajross 1y agoIt just fills the memory with 0xd4 bytes. That happens to be a trapping instruction if it's filling space between aligned 32-bit ARM instructions. It doesn't work to infill 16-bit holes in thumb instructions at all (i.e. it's not a trap), but when used for its intended purpose it presumably works fine.