Linux Moving Ahead With Enabling Kernel IBT By Default

Written by Michael Larabel in Linux Security on 5 November 2022 at 07:00 AM EDT. Add A Comment
LINUX SECURITY --
As an enhancement to the out-of-the-box Linux kernel in its default x86_64 configuration, it was being eyed to enable Indirect Branch Tracking by default. That change to enable IBT by default has been picked up by TIP's x86/core branch, thus putting it on deck as material for submitting with next month's Linux 6.2 merge window.

Indirect Branch Tracking is part of Intel Control-Flow Enforcement Technology (CET) with Tigerlake CPUs and newer. IBT provides indirect branch protection to defend against JOP/COP attacks by ensuring indirect calls land on an ENDBR instruction.

The Linux kernel has seen a lot of work by Intel engineers and others around Indirect Branch Tracking support as well as recently pursuing FineIBT, which might also be merged for Linux 6.2. The FineIBT approach aims to combine the best of Intel's CET with an alternative Control Flow Integrity (CFI) scheme.

This morning flipping on IBT by default as part of the stock x86/x86_64 Kconfig kernel configuration was merged to TIP's x86/core, so barring any last minute objections or other considerations by Linus Torvalds, it should be set for seeing in Linux 6.2.


Some Linux distribution vendor kernels already ship with the X86_KERNEL_IBT option enabled. For those on CPUs not having the hardware capability for IBT as part of the Control-flow Enforcement Technology, you won't notice any change in behavior, but for those on newer CPUs this is a good default as another layer of in-hardware security protection.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week