oss-sec mailing list archives

Re: Alternative CET ABI


From: Szabolcs Nagy <szabolcs.nagy () arm com>
Date: Thu, 30 Jul 2020 17:47:14 +0100

The 07/30/2020 18:41, Jann Horn wrote:
On Thu, Jul 30, 2020 at 6:02 PM Florian Weimer <fweimer () redhat com> wrote:
Functions no longer start with the ENDBR64 prefix.  Instead, the link
editor produces a PLT entry with an ENDBR64 prefix if it detects any
address-significant relocation for it.  The PLT entry performs a NOTRACK
jump to the target address.  This assumes that the target address is
subject to RELRO, of course, so that redirection is not possible.
Without address-significant relocations, the link editor produces a PLT
entry without the ENDBR64 prefix (but still with the NOTRACK jump), or
perhaps no PLT entry at all.

How would this interact with function pointer comparisons? As in, if
library A exports a function func1 without referencing it, and
libraries B and C both take references to func1, would they end up
with different function pointers (pointing to their respective PLT
entries)? Would this mean that the behavior of a program that compares

ld.so only needs to generate one plt entry
for a function in a process and that entry
can provided the canonical address that is
loaded from some got entry when the address
is used, so there is double indirection, but
it works.

function pointers obtained through different shared libraries might
change?

I guess you could maybe canonicalize function pointers somehow, but
that'd probably at least break dlclose(), right?
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you 
are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other 
person, use it for any purpose, or store or copy the information in any medium. Thank you.


Current thread: