Anon3 (anon3.delete@this.anon3.invalid) on August 17, 2020 5:34 pm wrote:
> Maynard Handley (name99.delete@this.name99.org) on August 17, 2020 4:34 pm wrote:
> > You are suggesting that jumping into the middle of a paid may be a security hole.
>
> I know it's a security hole. Both of the CFI mechanisms I mentioned bear more than a passing resemblance
> to a 2015 NSA paper called 'Hardware Control Flow Integrity (CFI) for an IT Ecosystem' I can't
> find the text online currently but I remember that it claimed a 70% reduction in gadgets in GLIBC
> by application of their proposal. I would not be at all surprised if the NSA strongly suggested
> to various companies that they should adopt something similar in to their ISAs.
>
> Obviously ARMv8 is fixed width so you don't have the jumping in to instructions
> issue but gadgets based on jumping to points which were not branch targets in the
> compiler intended control flow still exist, there are just fewer of them.
>
> > on the details of exactly how these pair instructions are implemented.
>
> It does not matter what the internal implementation is.

It absolutely does.

> It's a prefix opcode felling
> you to to decode the next opcode differently. Therefore there are now two different
> interpretations to the same opcode. This increases the gadget space.

No, not if you are prohibited from jumping into the middle of an instruction.

This can be done architecturally, by marking the suffix as such. Or micro-architecturally by pre-decoding and marking instruction boundaries, which is absolutely possible if you have alignment restrictions on prefix instruction crossings.