Security Mitigations: Difference between revisions
Jump to navigation
Jump to search
Confirmed to be present in 19.0.0 |
|||
| (One intermediate revision by the same user not shown) | |||
| Line 13: | Line 13: | ||
Support for --X was initially added with [19.0.0+], however it's only used on S2. | Support for --X was initially added with [19.0.0+], however it's only used on S2. | ||
S2 sysmodules have --X .text, starting with [19.0.0]. | S2 sysmodules have --X .text, starting with [[Switch_2:_19.0.0|19.0.0]]. | ||
= CFI (Control-Flow-Integrity) = | = CFI (Control-Flow-Integrity) = | ||
Besides the CFI used by [[Internet_Browser|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure. | Besides the CFI used by [[Internet_Browser|web-applets]], S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure. | ||
Latest revision as of 00:31, 20 January 2026
ASLR (Address Space Layout Randomization)
ASLR for userspace is supported.
KASLR (kernel) was added with 5.0.0. PASLR (physical) was added with 10.0.0.
RelRo
Support for RelRo (read-only-relocations) was added with 17.0.0, binaries built for [17.0.0+] use this.
PAC
[S2] PAC is used for retaddrs on stack.
XOM (eXecute-Only-Memory)
Support for --X was initially added with [19.0.0+], however it's only used on S2.
S2 sysmodules have --X .text, starting with 19.0.0.
CFI (Control-Flow-Integrity)
Besides the CFI used by web-applets, S2 sysmodules use a version of CFI which validate vtable-ptrs (the address of the ptr, without accessing the data located there). PAC is not used with this. An undefined-instruction exception is triggered on CFI failure.