Intel Working To Combine The Best Of CET + CFI Into "FineIBT"

[phoronix]

Phoronix: Intel Working To Combine The Best Of CET + CFI Into "FineIBT"

Intel security researchers have been working on implementing toolchain-optimized fine-grained Control Flow Integrity (CFI) support on top of Intel's hardware-based Control-flow Enforcement Technology (CET). By leveraging Intel CET, the Control-Flow Integrity overhead is much lower than the otherwise pure software/compiler-based approach. This Linux security improvement is being worked on under the name of FineIBT...

https://www.phoronix.com/scan.php?page=news_item&px=Intel-FineIBT-Security

[loganj]

"Intel security researchers"

[debrouxl]

PaX RAP was also advertised to have performance impact in the single-digit percentage range, without depending on the capabilities of hardware (from one specific vendor, at that) which is scarce, and will remain a minority in the real world for years (if not forever, considering that there are far more chips based on the ARMv* ISAs chips than x86_64 chips made by Intel chips, and then there are all of the other ISAs). Also, CET's not quite perfect, according to the makers of RAP, who have a great track record creating security defenses: https://forums.grsecurity.net/viewtopic.php?f=7&t=4490 .
But RAP's no longer publicly accessible, like the rest of vastly superior technologies with lower hardware requirements from PaX/grsecurity, because their authors couldn't make a living out of the voluntary donations, and were forced into free labor...