ARM Pointer Authentication [2017]
1–10 of 16 posts
Re: ARM Pointer Authentication [2017]
#2Protection was partially hacked with: https://pacmanattack.com
Re: ARM Pointer Authentication [2017]
#3PAC has been a total pain in the ass for iOS exploit devs. Seems to be working pretty well there.
Re: ARM Pointer Authentication [2017]
#4Protection was partially hacked with: https://pacmanattack.com
That is Apple silicon specific (at least for now?) as it isn’t a behaviour inherent to the ISA but rather it is yet another cache related side channel. It is of course entirely possible that other vendors will have the same info leak, but that particular paper seemed to be only interested in Apple hardware - I’m unsure how widely deployed PAC is in other vendor hardware so don’t know how feasible testing is.
[edit: this is also a 2017 article (I hadn't realized originally, cheers @dmytrish) so the gcc, etc support comments are presumably outdated]
Re: ARM Pointer Authentication [2017]
#5Protection was partially hacked with: https://pacmanattack.com
That is Apple silicon specific (at least for now?) as it isn’t a behaviour inherent to the ISA but rather it is yet another cache related side channel. It is of course entirely possible that other vendors will have the same info leak, but that particular paper seemed to be only interested in Apple hardware - I’m unsure how widely deployed PAC is in other vendor hardware so don’t know how feasible testing is. [edit: t…
If I recall that paper properly, they chose to do their work on the M1 because it was the only available chip with PAC at the time.
Re: ARM Pointer Authentication [2017]
#6Please add [2017]
Re: ARM Pointer Authentication [2017]
#7Earlier quoted context omitted.
That is Apple silicon specific (at least for now?) as it isn’t a behaviour inherent to the ISA but rather it is yet another cache related side channel. It is of course entirely possible that other vendors will have the same info leak, but that particular paper seemed to be only interested in Apple hardware - I’m unsure how widely deployed PAC is in other vendor hardware so don’t know how feasible testing is. [edit: t…
If I recall that paper properly, they chose to do their work on the M1 because it was the only available chip with PAC at the time.
They could have tried SPARC ADI instead.
Re: ARM Pointer Authentication [2017]
#8[deleted]
Re: ARM Pointer Authentication [2017]
#9> For the time being, the feature is only provided for user space; it is not yet used within the kernel itself
Does anyone know if that is still the case?
Re: ARM Pointer Authentication [2017]
#10Why just use separate stacks for code and data if you can engineer a more complicated solution with higher overhead?