advanced-microcode-patching / shiva

A custom ELF linker/loader for installing ET_REL binary patches at runtime
Other
146 stars 13 forks source link

Fix known security issues in Shiva #9

Open elfmaster opened 1 year ago

elfmaster commented 1 year ago
  1. Remove the global reference to context. Currently we have: struct shiva_ctx *ctx_global defined as a global initialized variable in shiva.c. This global variable is predictable in the AARCH64 version because our Interpreter is an ET_EXEC (vs. PIE ET_DYN). This means that an attacker who's exploiting a memory corruption vulnerability could use this as leak to determine the ASLR space or gain access to other read/write primitives.

(Will add more to the list)