Adds checks for IntelCET Indirect Branch Tracking (IBT) and Shadow Stack (SHSTK) #43
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I hope this PR will be merged and included in a crates.io release of Note for anyone maintaining a project that uses the latest [dependencies]
goblin = "0.7"
checksec_goblin = { package = "goblin", version = "0.5" } |
|
I am happy to help :) You can now check for Shadow Stack compatibility on PE Files as-well. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Checks the
.note.gnu.propertysection of an ELF file for the properties GNU_PROPERTY_X86_FEATURE_1_IBT (Indirect branch tracking) and GNU_PROPERTY_X86_FEATURE_1_SHSTK (Shadow Stack)These are features from the Intel Control-flow Enforcement Technology (IntelCET) (Architectures Software
Developer’s Manual Volume 1 - Chapter 17), which will provide hardware supported control flow checks in the future. This is intended to protect against such threats as Return-oriented Programming (ROP), and similarly call/jmp-oriented programming (COP/JOP). Unlike software solutions, this also works during Spectre-like attacks. While the ShadowStack ist already supported by multiple CPUs by both Intel and AMD, IBT is only supported by Intel Tiger Lake as of now. However, GCC is in the process of introducing a new -fhardened [1] [2] flag, which includes this feature. Thus, i value this to be a relevant feature to check for.
IBT and SHSTK can be enabled during compilation with the following flags:
*CFLAGS=*-fcf-protection=[full|branch|return|none]linkNotes:
NT_GNU_PROPERTY_TYPE_0constant for this. I set the Goblin version to the latest current version of 0.7.1. However, 0.6.1 would be sufficient for this patch to work if you don't want Goblin 0.7.x.Future Work:EDIT: DoneWhile Windows does not make use of the Indirect branch tracking feature, you can enable the shadow stack link. Thus, PE files should/could also be checked for this.