linux-kernel - Re: [RFC] Circumventing FineIBT Via Entrypoints

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG48ez20UKXNW0jy+eO9_DT8aYeKZu3GBE6wU2xGFTBwo_ChzA@mail.gmail.com>
Date: Fri, 14 Feb 2025 00:43:45 +0100
From: Jann Horn <jannh@...gle.com>
To: Jennifer Miller <jmill@....edu>
Cc: Andrew Cooper <andrew.cooper3@...rix.com>, Andy Lutomirski <luto@...nel.org>, 
	linux-hardening@...r.kernel.org, kees@...nel.org, joao@...rdrivepizza.com, 
	samitolvanen@...gle.com, kernel list <linux-kernel@...r.kernel.org>
Subject: Re: [RFC] Circumventing FineIBT Via Entrypoints

On Fri, Feb 14, 2025 at 12:24 AM Jennifer Miller <jmill@....edu> wrote:
> On Thu, Feb 13, 2025 at 09:24:18PM +0000, Andrew Cooper wrote:
> > On 13/02/2025 7:23 pm, Jann Horn wrote:
> > > How would we actually do that overwriting and restoring of
> > > KERNEL_GS_BASE? Would we need a scratch register for that?
> >
>
> I think we can do the overwrite at any point before actually calling into
> the individual syscall handlers, really anywhere before potentially
> hijacked indirect control flow can occur and then restore it just after
> those return e.g., for the 64-bit path I am currently overwriting it at the
> start of do_syscall_64 and then restoring it just before
> syscall_exit_to_user_mode. I'm not sure if there is any reason to do it
> sooner while we'd still be register constrained.

Right, makes sense - sorry, I misremembered the details of the
KERNEL_GS_BASE overwrite proposal, I had to re-read your first mail.