[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 30 Jul 2020 18:41:40 +0200
From: Jann Horn <jannh@...gle.com>
To: Florian Weimer <fweimer@...hat.com>
Cc: oss-security@...ts.openwall.com, x86-64-abi@...glegroups.com,
Kernel Hardening <kernel-hardening@...ts.openwall.com>, Szabolcs Nagy <szabolcs.nagy@....com>
Subject: Re: Alternative CET ABI
On Thu, Jul 30, 2020 at 6:02 PM Florian Weimer <fweimer@...hat.com> wrote:
> Functions no longer start with the ENDBR64 prefix. Instead, the link
> editor produces a PLT entry with an ENDBR64 prefix if it detects any
> address-significant relocation for it. The PLT entry performs a NOTRACK
> jump to the target address. This assumes that the target address is
> subject to RELRO, of course, so that redirection is not possible.
> Without address-significant relocations, the link editor produces a PLT
> entry without the ENDBR64 prefix (but still with the NOTRACK jump), or
> perhaps no PLT entry at all.
How would this interact with function pointer comparisons? As in, if
library A exports a function func1 without referencing it, and
libraries B and C both take references to func1, would they end up
with different function pointers (pointing to their respective PLT
entries)? Would this mean that the behavior of a program that compares
function pointers obtained through different shared libraries might
change?
I guess you could maybe canonicalize function pointers somehow, but
that'd probably at least break dlclose(), right?
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
