llvm / llvm/llvm-project

[PAC][libunwind] Signing oracles in UnwindCursor::getInfoFromFdeCie

Open
#184,883 1 comment 0 reactions 1 assignee Claimed by @atrosinenko View on GitHub
libunwind
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Five signing oracles are reported by PAuth gadget scanner of `llvm-bolt-binary-analysis` (see https://github.com/llvm/llvm-project/issues/165244#issuecomment-4007695426 for the details) for `getInfoFromFdeCie` function from [`UnwindCursor.hpp`](https://github.com/llvm/llvm-project/blob/24ac5987b482edb33b73f0ebff509e0a520eca1c/libunwind/src/UnwindCursor.hpp#L1735). They correspond to copying 5 non-signed variables into `__ptrauth`-qualified fields of `_info` struct of type [`unw_proc_info_t`](https://github.com/llvm/llvm-project/blob/24ac5987b482edb33b73f0ebff509e0a520eca1c/libunwind/include/libunwind.h#L193): `start_ip`, `end_ip`, `lsda`, `unwind_info` and `extra`. Only one value being signed in this function corresponds to an already signed value being re-signed (assigning `cieInfo.personality` to `_info.handler`).

```cpp
template
bool UnwindCursor::getInfoFromFdeCie(
const typename CFI_Parser::FDE_Info &fdeInfo,
const typename CFI_Parser
::CIE_Info &cieInfo,
typename R::link_hardened_reg_arg_t pc, uintptr_t dso_base) {
typename CFI_Parser
::PrologInfo prolog;
if (CFI_Parser
::template parseFDEInstructions(
_addressSpace, fdeInfo, cieInfo, pc, R::getArch(), &prolog)) {
// Save off parsed FDE info
_info.start_ip = fdeInfo.pcStart; // signing oracle
_info.end_ip = fdeInfo.pcEnd; // signing oracle
_info.lsda = fdeInfo.lsda; // signing oracle
_info.handler = cieInfo.personality; // safe re-signing
_info.gp = prolog.spExtraArgSize;
_info.flags = 0;
_info.format = dwarfEncoding();
_info.unwind_info = fdeInfo.fdeStart; // signing oracle
_info.unwind_info_size = static_cast(fdeInfo.fdeLength);
_info.extra = static_cast(dso_base); // signing oracle
return true;
}
return false;
}
```

4 out of 5 fields of `unw_proc_info_t` are assigned from non-protected fields of `CFI_Parser::FDE_Info`. Adding `__ptrauth` qualifiers to these four fields shifts signing oracles from `getInfoFromFdeCie` to other functions (and seems to increase number of such oracles).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.