|
@AmarSaar | |||||
|
In those CET times: It's possible to return in unwinding to any address in the SSP, causing a "type confusion" between stack frames ;)
I really like the different variants of this concept twitter.com/AmarSaar/statu…:) Type confusions are on fire! (stack frames, objc for PAC bypass) twitter.com/yarden_shafir/…
|
||||||
|
||||||
|
Elazar Leibovich
@elazarl
|
21. sij |
|
Can you explain? I'm not sure what do you mean "type confusion" in this context. CET contains only return address that has been called? Do you mean somehow ret32 for a 64 bit ssp?
|
||
|
|
||
|
Saar Amar
@AmarSaar
|
21. sij |
|
No. You can return into an address which the original flow didn't intend, but you control the registers :)
|
||
|
|
||
|
Yarden Shafir
@yarden_shafir
|
21. sij |
|
You beat me to it! Planned to PoC this at some point and never got the time. Would love to see a nice sample of this if you have one 😊
|
||
|
|
||
|
Deepak
@0xdbug
|
1. velj |
|
You will need either 1) incssp ending in ret/jmp/call or 2) free rstor token. SSP register can’t be easily modified. Even incssp can’t run over more than a page in one go.
Not saying not doable (if there is crappy implementation) but it puts good amount of constraints on adv
|
||
|
|
||
|
Deepak
@0xdbug
|
1. velj |
|
Plus even if you get to a free restore token in program address space, you will need usable rstorssp gadget (rstorssp ending in Ret/jmp/call). Plus opcodes of all SSP management instructions are minimum 4 bytes. And thus probability is less.
|
||
|
|
||
|
Kunal Mehta
@kmgkv1
|
22. sij |
|
Would be interesting to see how this work
|
||
|
|
||