Messages in this thread | | | From | Andrew Cooper <> | Subject | Re: [PATCH v2 07/39] x86/entry: Sprinkle ENDBR dust | Date | Fri, 25 Feb 2022 09:22:26 +0000 |
| |
On 25/02/2022 00:42, Kees Cook wrote: > On Thu, Feb 24, 2022 at 03:51:45PM +0100, Peter Zijlstra wrote: >> The SYSCALL entry points are found through taking their respective >> address in order to program them in the MSRs, while the exception >> entry points are found through UNWIND_HINT_IRET_REGS. > Stupid question: does CET consider exception and syscall entry points to > be indirect calls? (I would expect so, but they're ever so slightly > differently executed...)
Yes it does. What happens is that on ring transition, microcode forces the WAIT-FOR-ENDBR state.
For IDT entries, this protects against a single stray write hijacking control flow.
SYSCALL/SYSENTER in principle don't need to be, IMO. They're rooted in MSRs rather than RAM, and if an attacker has hijacked the system enough to change those, then the absence of ENDBR is not going to save you.
However, from a consistency and implementation point of view, you don't want to be special casing how a ring transition was triggered.
~Andrew
| |