llvm / llvm/llvm-project

[PAC][runtimes] Fix signing/authentication oracles (if any) introduced by unwinding hardening

Open
#165,244 5 comments 0 reactions 0 assignees View on GitHub
libunwind
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

#143230 introduced usage of pointer authentication for hardening unwinding. As mentioned by @atrosinenko during review, usage of `__ptrauth`-qualified fields might cause signing or authentication oracles. We need to look through the introduced changes and fix the oracles found.

_Originally posted by @atrosinenko in https://github.com/llvm/llvm-project/pull/143230#pullrequestreview-2959407980_

> The fact I'm worried about is whether implicit signing and authentication on accesses to `__ptrauth`-qualified fields may introduce signing or authentication oracles usable by an attacker, since many values stored to these fields are initially non-signed. This is possibly mitigated by the fact that all these fields use address diversity with distinct integer discriminators and/or the original values are taken from read-only memory. On the other hand, discriminator computation, auth / sign intrinsic and load / store to memory are currently three separate operations when accessing a `__ptrauth`-qualified field, thus spilling of intermediate values to the stack is possible. Furthermore, even if the non-signed value originates from a read-only memory, this is not expressed in LLVM IR terms, thus the optimization pipeline may transform sensitive instruction sequences in an unsafe way.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing PR #143230 and the linked review discussion about __ptrauth-qualified fields in the unwinding hardening changes. Trace each introduced field access and assess whether implicit signing, authentication, discriminator computation, or intermediate spills can create an oracle. Done means identifying any vulnerable sequences and fixing them with appropriate validation.

Written by the indexing model from the issue text.

Assessment

Domain
compilers, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.