* Re: [PATCH 00/10] Control Flow Enforcement - Part (3) [not found] <20180607143807.3611-1-yu-cheng.yu@intel.com> @ 2018-06-26 5:26 ` Andy Lutomirski 2018-06-26 14:56 ` Yu-cheng Yu 0 siblings, 1 reply; 2+ messages in thread From: Andy Lutomirski @ 2018-06-26 5:26 UTC (permalink / raw) To: Yu-cheng Yu, Linux API, Jann Horn, Florian Weimer Cc: LKML, linux-doc, Linux-MM, linux-arch, X86 ML, H. Peter Anvin, Thomas Gleixner, Ingo Molnar, H. J. Lu, Shanbhogue, Vedvyas, Ravi V. Shankar, Dave Hansen, Jonathan Corbet, Oleg Nesterov, Arnd Bergmann, mike.kravetz On Thu, Jun 7, 2018 at 7:41 AM Yu-cheng Yu <yu-cheng.yu@intel.com> wrote: > > This series introduces CET - Shadow stack I think you should add some mitigation against sigreturn-oriented programming. How about creating some special token on the shadow stack that indicates the presence of a signal frame at a particular address when delivering a signal and verifying and popping that token in sigreturn? The token could be literally the address of the signal frame, and you could make this unambiguous by failing sigreturn if CET is on and the signal frame is in executable memory. IOW, it would be a shame if sigreturn() itself became a convenient CET-bypassing gadget. --Andy ^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH 00/10] Control Flow Enforcement - Part (3) 2018-06-26 5:26 ` [PATCH 00/10] Control Flow Enforcement - Part (3) Andy Lutomirski @ 2018-06-26 14:56 ` Yu-cheng Yu 0 siblings, 0 replies; 2+ messages in thread From: Yu-cheng Yu @ 2018-06-26 14:56 UTC (permalink / raw) To: Andy Lutomirski, Linux API, Jann Horn, Florian Weimer Cc: LKML, linux-doc, Linux-MM, linux-arch, X86 ML, H. Peter Anvin, Thomas Gleixner, Ingo Molnar, H. J. Lu, Shanbhogue, Vedvyas, Ravi V. Shankar, Dave Hansen, Jonathan Corbet, Oleg Nesterov, Arnd Bergmann, mike.kravetz On Mon, 2018-06-25 at 22:26 -0700, Andy Lutomirski wrote: > On Thu, Jun 7, 2018 at 7:41 AM Yu-cheng Yu <yu-cheng.yu@intel.com> > wrote: > > > > > > This series introduces CET - Shadow stack > I think you should add some mitigation against sigreturn-oriented > programming. How about creating some special token on the shadow > stack that indicates the presence of a signal frame at a particular > address when delivering a signal and verifying and popping that token > in sigreturn? The token could be literally the address of the signal > frame, and you could make this unambiguous by failing sigreturn if > CET > is on and the signal frame is in executable memory. > > IOW, it would be a shame if sigreturn() itself became a convenient > CET-bypassing gadget. > > --Andy I will look into that. Thanks, Yu-cheng ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-06-26 14:56 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20180607143807.3611-1-yu-cheng.yu@intel.com>
2018-06-26 5:26 ` [PATCH 00/10] Control Flow Enforcement - Part (3) Andy Lutomirski
2018-06-26 14:56 ` Yu-cheng Yu
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox