TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

RIP ROP: CET Internals in Windows 20H1

72 点作者 aw1621107将近 5 年前

7 条评论

schoen将近 5 年前
We&#x27;ve been through several generations of exploit mitigations starting with non-executable stacks, and, impressively, exploit developers found workarounds for each of them (although often the particular workarounds have requirements that might not be met in a particular vulnerability environment). In many cases I had the impression that the workarounds were surprising to the mitigation developers because the latter had expressed a lot of confidence that software security was about to make a huge leap and memory safety violations would rarely be exploitable anymore.<p>What are the prospects for finding workarounds to CET too?<p>(I don&#x27;t mean to argue that there&#x27;s no benefit to these mitigations or that some of them might not eventually finally stop whole classes of vulnerabilities. But I feel like their track record is not nearly as awesome as their inventors anticipated, so I wonder what informed opinion is on the eventual relevance or irrelevance of this one. Notably, the &quot;RIP ROP&quot; seems like a somewhat ambitious claim to mitigate a large amount of attack potential; how well-justified is it?)
评论 #23912356 未加载
评论 #23912019 未加载
评论 #23914679 未加载
评论 #23913721 未加载
rwmj将近 5 年前
Fedora has been implementing this for a while. It will finally be enabled in Fedora 33 later this year: <a href="https:&#x2F;&#x2F;bugzilla.redhat.com&#x2F;show_bug.cgi?id=1802674#c3" rel="nofollow">https:&#x2F;&#x2F;bugzilla.redhat.com&#x2F;show_bug.cgi?id=1802674#c3</a><p>Of course you&#x27;ll need a TigerLake chip for it to do anything. Are those even released yet?
muska3将近 5 年前
TLDR? Why does this matter?<p>&quot;As a reminder, Intel CET is a hardware-based mitigation that addresses the two types of control-flow integrity violations commonly used by exploits: forward-edge violations (indirect CALL and JMP instructions) and backward-edge violations (RET instructions). &quot;<p>Why are these important
评论 #23910466 未加载
评论 #23910483 未加载
评论 #23910551 未加载
评论 #23911077 未加载
WrathOfJay将近 5 年前
And how about performance impact? The mitigation&#x27;s that have been done in software recently came with an ugly performance cost (just not as ugly as the vulnerability). Is there any speculation about what this is going to cost?
评论 #23911918 未加载
exikyut将近 5 年前
An aside that I was curious about: &quot;20H1&quot;?<p>I found <a href="https:&#x2F;&#x2F;blogs.windows.com&#x2F;windowsexperience&#x2F;2020&#x2F;06&#x2F;16&#x2F;whats-next-for-windows-10-updates&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blogs.windows.com&#x2F;windowsexperience&#x2F;2020&#x2F;06&#x2F;16&#x2F;whats...</a>:<p>&gt; <i>Windows 10, version 20H2 is, therefore, “20H2” because it will be released in the second half of the 2020 calendar year.</i><p>So 20H1 is 2020 1st half then. And Windows now has biannual rolling release? Nice.
stellersjay将近 5 年前
Exploit devs love a good challenge. Each mitigation is another lessons learned :)
评论 #23913594 未加载
JaimeThompson将近 5 年前
Does anyone know when AMD will have equivalent support?
评论 #23914583 未加载