Post #3041986
2025-09-09 19:18 UTC
/2 The trick behind this mitigation is to use the compiler to clamp all pointer offset operations in kernel code to a magnitude of less than 4GB. If you feel like grep-ing, the specific codegen for this clamp operation currently uses a special 0x2BAD poisoning pattern in the top 16 bits when the magnitude exceeds 4GB.
With some VA layout tricks to inject large 4GB unmapped gutters between major kernel VA regions, this has some delightful consequences.
Replies (2)
-
@ezhes_@mastodon.online 2025-09-09 19:20
/3 For example, a first-order arb offset OOB write in a kalloc_type submap can now only target the per-boot random set of types on that same submap front, which can make exploiting what used to be one of the best flavors of bug quite hard. This is even more fun when considering the data submap where an arb write is now restricted to targeting only other data allocations. Any types (eg. pointers, indexes, etc.) you could target to escape the data heap are themselves patchable security bugs :)
-
@gtr@infosec.exchange 2025-09-10 07:58
@ezhes_@mastodon.online Thanks, this part wasn't clear from the blog post. What incredible work by the team, and bonus humor points to someone for the poisoning pattern 😁