4 ms·
I know everyone is a bit tired of hearing about the new Mill CPU, but one of the things we've done with the architecture is to have the hardware track return ad
by willvarfar 13y ago
I know everyone is a bit tired of hearing about the new Mill CPU, but one of the things we've done with the architecture is to have the hardware track return addresses. This is not only much faster and efficient; it is also immune to these kinds of attacks.
There's an upcoming "Security" talk which will cover lots of other ways we've worked to improve the fundamental protection offered by the CPU, but the stack is covered in the Memory talk: http://ootbcomp.com/topic/memory/ http://ootbcomp.com/topic/memory/ and ootbcomp.com/topic/introduction-to-the-mill-cpu-programming-model-2/
- pohl 13y agoI know everyone is a bit tired of hearing about the new Mill CPU Well, damn, I must be late to the party. The Mill just caught my attention a week ago, and I'm far from being tired of hearing about it. Thank you for sharing what you can.
- nhaehnle 13y agoAs has been pointed out on the LWN thread, buffer overflows even on the stack can also leave you vulnerable by overwriting other automatic variables, e.g. a variable that indicates whether a client is authenticated as an administrator.
- willvarfar 13y agoYes this is completely true. I meant particularly the return-to-libc type of attacks that the canary (to some extent) protects against, when I claimed immunity (and improved performance). We have some stuff to talk about on the protecting authentication flags and things front too, but I'm afraid that'll have to wait for the Security talk. One other security-related aspect that we have already presented is how stack debris is not readable once returned, so malicious code can't go looking at it. We've also talked a little bit about how we don't have rings, and we have very cheap syscalls across protection boundaries. So there are some hints of stuff to come.
- mparlane 13y agoROP chains.
- emillon 13y agoOn the conceptual level, ROP and return into libc are the same thing. You need to start them by overwriting an address somewhere, and the return address is a natural candidate.
- willvarfar 13y agoYes, the Security talk will cover ROP too :). Stay tuned. The Mill is far from exploit-free, but vast swathes of attacks can be stopped or mitigated and we do our best.
- habitue 13y agoKnuth's MMIX[0] architecture also has a "hardware" stack (scare quotes because it isn't implemented in real hardware) [0]http://en.wikipedia.org/wiki/MMIX http://en.wikipedia.org/wiki/MMIX
- pjmlp 13y agoI am not, I love to learn about new architectures.