lkml.org 
[lkml]   [2022]   [Oct]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [RFC PATCH 0/2] Branch Target Injection (BTI) gadget in minstrel
    From
    On 10/25/22 04:07, Peter Zijlstra wrote:
    > I think the focus should be on finding the source sites, not protecting
    > the target sites. Where can an attacker control the register content and
    > have an indirect jump/call.

    How would this work with something like 'struct file_operations' which
    provide a rich set of indirect calls that frequently have fully
    user-controlled values in registers?

    It certainly wouldn't *hurt* to be zeroing out the registers that are
    unused at indirect call sites. But, the majority of gadgets in this
    case used rdi and rsi, which are the least likely to be able to be
    zapped at call sites.

    \
     
     \ /
      Last update: 2022-10-26 00:01    [W:3.278 / U:0.560 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site