| 2bc3a8c0 | 15-Oct-2020 |
deraadt <deraadt@openbsd.org> |
crt0 MD _dl_exit() performs syscall to SYS_exit directly, but then some of these functions were returning. That makes the +1word address a fairly strong and easily located gadget. Put a hard-trap i
crt0 MD _dl_exit() performs syscall to SYS_exit directly, but then some of these functions were returning. That makes the +1word address a fairly strong and easily located gadget. Put a hard-trap instruction after the syscall. This remains a gadget for 'terminal system' calls (such as execve), but hey that's why we have pledge w/o "exec" throughout the tree. Quite surprisingly, hppa's delay-slot load of SYS_exit makes it the safest of the bunch, not that this helps anyone. ok kettenis
show more ...
|