Re: ARM is channeling the IBM 360

John Dallman wrote:

In article <bebb9f88a6677b4894478a3dabc8b2c9@www.novabbs.org>,
mitchalsup@aol.com (MitchAlsup1) wrote:

The 4 seconds part leads me to believe the attackers are using brute
force, since in 4 seconds one can try something like 2^28 patterns.

Makes sense: there's probably a hash of the block address involved in
generating those 4-bit tags, and they're brute-forcing the salt.

Memory Tagging Extension doesn't seem to have been heavily used as yet,
which may be why ARM aren't very worried about it.

Pointer Authentication Code in ARMv8.3 is usable within functions, but
has problems, in that compilers can't readily tell if stored pointers
have PAC signatures.

Branch Target Indicators in ARMv8.5 work quite well, but need linker
and
loader support.

Is one worried about branches within a single subroutine getting
bonked (execute but no write permissions).
If not, then disallowing the application code from writing GOT should
solve the problem. The dynamic linker will not setup a GOT entry that
is not an actual entry point allowed.
But perhaps some kind of abuse of method calling would enable an entry
point pointer to get bonked.....

PAC and BTI use instructions that are no-ops in earlier versions of
ARM64,
but you really ought to test that they work before releasing binaries
that include them. I've done that on Android, where I had the
combination
of hardware, OS and compiler to do it.

Once I can get an ARM Linux server with the hardware support, Linux
kernel 5.0 onwards and modern GCC will let me do it there. Windows and
macOS on ARM both lack some pieces, and iOS requires you to change ABIs
and drop support for older 64-bit devices.

John