Skip to content

[PAC] Do not store unsigned LR in memory in raw assembly code #3

@kovdan01

Description

@kovdan01

There are several places, where unsigned x30 (LR) is stored in memory, being vulnerable for substitution.

  1. crt/aarch64/crtn.s and crt/aarch64/crti.s - load/store or LR in context of .init and .fini (not to be messed up with .init_array and .fini_array)

  2. src/signal/aarch64/sigsetjmp.s - store/load of unsigned LR in prologue/epilogue

  3. src/setjmp/aarch64/setjmp.s - store unsigned LR to jump context structure

  4. src/setjmp/aarch64/longjmp.s - restore unsigned LR from jump context structure

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions