oss-sec mailing list archives
Re: Alternative CET ABI
From: Jann Horn <jannh () google com>
Date: Thu, 30 Jul 2020 18:41:40 +0200
On Thu, Jul 30, 2020 at 6:02 PM Florian Weimer <fweimer () redhat com> wrote:
Functions no longer start with the ENDBR64 prefix. Instead, the link editor produces a PLT entry with an ENDBR64 prefix if it detects any address-significant relocation for it. The PLT entry performs a NOTRACK jump to the target address. This assumes that the target address is subject to RELRO, of course, so that redirection is not possible. Without address-significant relocations, the link editor produces a PLT entry without the ENDBR64 prefix (but still with the NOTRACK jump), or perhaps no PLT entry at all.
How would this interact with function pointer comparisons? As in, if library A exports a function func1 without referencing it, and libraries B and C both take references to func1, would they end up with different function pointers (pointing to their respective PLT entries)? Would this mean that the behavior of a program that compares function pointers obtained through different shared libraries might change? I guess you could maybe canonicalize function pointers somehow, but that'd probably at least break dlclose(), right?
Current thread:
- Alternative CET ABI Florian Weimer (Jul 30)
- Re: Alternative CET ABI Jann Horn (Jul 30)
- Re: Alternative CET ABI Florian Weimer (Jul 30)
- Re: Alternative CET ABI H.J. Lu (Jul 30)
- Re: Alternative CET ABI Szabolcs Nagy (Jul 30)
- Re: Alternative CET ABI Florian Weimer (Jul 30)
- Re: Alternative CET ABI Jann Horn (Jul 30)