Re:Retpoline: A Branch Target Injection Mitigation [pdf]
by anarazel on Tuesday February 20, 2018 @07:15PM
(#16425632)
But there's plenty userland software that has code with different privilege levels running in it. E.g. databases.
Re:Retpoline: A Branch Target Injection Mitigation [pdf]
by jesup on Tuesday February 20, 2018 @11:39PM
(#16426885)
"Linux, for instance, does not support arbitrary call depth and barely uses recursion."
Perhaps there's context missing from that statement? Linux certainly can have arbitrarily deep call depth, depending on the stack size. Are you referring to the kernel? That would be odd, since the paper talks about application code needing to be fully recompiled with retpoline to be safe.
(Of course, that means that all libraries you link with or dynamically load have to be compiled with retpoline too.)
You ask how it can be guaranteed with "general code". The first thing to remember is that retpoline is not for "general code". Linux, for instance, does not support arbitrary call depth and barely uses recursion.
Also, take a close look at the "Exploit Composition" section of the paper. Those five conditions are much harder to satisfy at 'RET' than they are during the demonstrated Spectre variant 2 exploit points. For instance, a long speculation window (#5) for 'RET' is interesting to generate since it means a stall while waiting on something to come off the stack.