Experimental "FineIBT" Series Published For Linux - Building Atop Intel CET/IBT

Written by Michael Larabel in Linux Security on 20 April 2022 at 02:00 PM EDT. 2 Comments
LINUX SECURITY
Merged as part of Linux 5.18 is Intel's Indirect Branch Tracking (IBT) support as part of CET (Control Flow Enforcement) technology. Indirect Branch Tracking is intended to help protect against JUMP/CALL oriented attacks as part of CET's control-flow integrity protections. Meanwhile still being worked on is "FineIBT" as a more compiler-hardened version built atop Intel CET/IBT.

Going back to last summer were patches around FineIBT as compiler-based control-flow integrity (CFI) with IBT. Sent out today are a new request-for-comments patch series of FineIBT for the Linux kernel.

This new Linux FineIBT patch series from Joao Moreira sums up the work as:
Disclaimer: This is all in a very early/poc stage and is mostly research work -- be advised to proceed with care and to bring a towel with you.

This patch series enables FineIBT in the kernel. FineIBT is a compiler-enhanced forward-edge CFI scheme built on top of Intel's CET-IBT that works by setting a hash on the caller side which is then checked at the callee side. Because IBT requires indirect branches to land on ENDBR instructions, these hash checks shouldn't be bypassable on the occasion of function pointer corruption.

When compared to IBT itself, FineIBT imposes a more restrictive policy that should be more robust against control-flow hijacking attacks. When compared to schemes like KCFI, it has the benefit of not depending on memory reads (which not only might be more efficient in terms of performance and power but also makes it compatible with XOM) and brings in the benefits of IBT regarding speculative execution hardening.

This FineIBT patch series is building off the Indirect Branch Tracking work upstreamed in Linux 5.18 and additional patches being worked on by Intel's Peter Zijlstra. For now this FineIBT work also relies upon a modified version of the Clang compiler.


FineIBT is another effort at improving Linux system security, paired with latest x86_64 hardware.


Learn more about this experimental FineIBT work via the kernel mailing list.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week