Re:Rust's unsafe pointer types need an overhaul
by staticassertion on Sunday March 20, 2022 @05:28PM
(#30746829)
Example:
> If we can find a legitimate user client that provides an implementation of getTargetAndTrapForIndex() that returns a pointer to an IOExternalTrap residing in writable memory, then all we have to do is replace trap->func with a PACIZA'd function pointer (that is, a pointer signed under APIAKey with context 0). That means only a partial PAC bypass, such as the ability to forge just PACIZA pointers, would be sufficient.
> If we can find a legitimate user client that provides an implementation of getTargetAndTrapForIndex() that returns a pointer to an IOExternalTrap residing in writable memory, then all we have to do is replace trap->func with a PACIZA'd function pointer (that is, a pointer signed under APIAKey with context 0). That means only a partial PAC bypass, such as the ability to forge just PACIZA pointers, would be sufficient.
https://googleprojectzero.blogspot.com/2019/02/examining-poi...
How are you going to overwrite memory with CHERI? It cuts off a key primitive for bypassing PAC.