Linux Still Eyes Better Security By Default Enabling Indirect Branch Tracking (IBT)

Indirect Branch Tracking (IBT) is still being eyed for enabling as part of the default Linux x86_64 kernel configurations to provide better out-of-the-box security on supported processors. A patch sent out today continues the upstream discussion over flipping on this feature by default that is part of Intel's Control-flow Enforcement Technology (CET) for helping to defend against jump/call oriented programming attacks.

Indirect Branch Tracking is part of CET found with Intel Tigerlake CPUs and newer. The Linux kernel support for IBT was merged in Linux 5.18 but to this point hasn't been enabled by default as part of the stock kernel configuration.

Kees Cook with Google has sent out his latest proposal arguing for it to see being enabled by default as part of the Linux kernel configuration. Back in early September he originally proposed this change while sent out today was the v2 patch to reignite the discussion. In there he sums up the situation:

The kernel IBT defense strongly mitigates the common "first step" of ROP attacks, by eliminating arbitrary stack pivots (that appear either at the end of a function or in immediate values), which cannot be reached if indirect calls must be to marked function entry addresses. IBT is also required to be enabled to gain the FineIBT feature when built with Kernel Control Flow Integrity.

Additionally, given that this feature is runtime enabled via CPU ID, it clearly should be built in by default; it will only be enabled if the CPU supports it. The build takes 2 seconds longer, which seems a small price to pay for gaining this coverage by default.

If all goes well it's possible we could see this enabled by default with the v6.2 kernel cycle meanwhile many Linux distribution vendors are already enabling X86_KERNEL_IBT as part of their provided kernel builds.