search

access-softek / musl

Fork of upstream musl libc repo with some local modifications
Other
0 stars 0 forks source link

[PAC] Do not store unsigned LR in memory in raw assembly code #3

Open kovdan01 opened 1 month ago

kovdan01 commented 1 month ago

There are several places, where unsigned x30 (LR) is stored in memory, being vulnerable for substitution.

  1. crt/aarch64/crtn.s and crt/aarch64/crti.s - load/store or LR in context of .init and .fini (not to be messed up with .init_array and .fini_array)

  2. src/signal/aarch64/sigsetjmp.s - store/load of unsigned LR in prologue/epilogue

  3. src/setjmp/aarch64/setjmp.s - store unsigned LR to jump context structure

  4. src/setjmp/aarch64/longjmp.s - restore unsigned LR from jump context structure

kovdan01 commented 1 month ago

Tagging @asl