Experimental "FineIBT" Series Published For Linux - Building Atop Intel CET/IBT
Going back to last summer were patches around FineIBT as compiler-based control-flow integrity (CFI) with IBT. Sent out today are a new request-for-comments patch series of FineIBT for the Linux kernel.
This new Linux FineIBT patch series from Joao Moreira sums up the work as:
Disclaimer: This is all in a very early/poc stage and is mostly research work -- be advised to proceed with care and to bring a towel with you.
This patch series enables FineIBT in the kernel. FineIBT is a compiler-enhanced forward-edge CFI scheme built on top of Intel's CET-IBT that works by setting a hash on the caller side which is then checked at the callee side. Because IBT requires indirect branches to land on ENDBR instructions, these hash checks shouldn't be bypassable on the occasion of function pointer corruption.
When compared to IBT itself, FineIBT imposes a more restrictive policy that should be more robust against control-flow hijacking attacks. When compared to schemes like KCFI, it has the benefit of not depending on memory reads (which not only might be more efficient in terms of performance and power but also makes it compatible with XOM) and brings in the benefits of IBT regarding speculative execution hardening.
This FineIBT patch series is building off the Indirect Branch Tracking work upstreamed in Linux 5.18 and additional patches being worked on by Intel's Peter Zijlstra. For now this FineIBT work also relies upon a modified version of the Clang compiler.
FineIBT is another effort at improving Linux system security, paired with latest x86_64 hardware.
Learn more about this experimental FineIBT work via the kernel mailing list.
2 Comments
