[Bug target/96350] [cet] For ENDBR immediate, the binary would include a gadget that starts with a fake ENDBR64 opcode.

rguenth at gcc dot gnu.org gcc-bugzilla@gcc.gnu.org
Tue Jul 28 06:17:50 GMT 2020


https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96350

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
The endbr are way too short to make this practical - ISTR I raised this exact
issue at a presentation about CET ... CET simply makes the gadget finding less
likely to succeed.

There's always the possibility that text relocations end up making ENDBR{32,64}
appear.

Eventually the assembler (and ld.so?) can receive a hardening flag to scan for
those byte sequences.


More information about the Gcc-bugs mailing list