Post #3041987
2025-09-09 19:20 UTC
/3 For example, a first-order arb offset OOB write in a kalloc_type submap can now only target the per-boot random set of types on that same submap front, which can make exploiting what used to be one of the best flavors of bug quite hard.
This is even more fun when considering the data submap where an arb write is now restricted to targeting only other data allocations. Any types (eg. pointers, indexes, etc.) you could target to escape the data heap are themselves patchable security bugs :)
Replies (1)
-
@ezhes_@mastodon.online 2025-09-09 19:31
/4 and, best of all, these same properties work identically to mitigate arb offset OOB Spectre v1 gadgets in a way which is performant enough to ship in a consumer product. This lets us defend MTE tags in the kernel against Spectre V1 by forcing attackers to deal with type isolation in order to leak the tags they need to further their memory corruption related attacks.