DEF CON 34 - Main - Breaking Hardware CFI with Sigreturn - Omri Ben Bassat
DEFCONConference · 25:05 · Watch on YouTube
SOBTI is a new CFI bypass: Linux's rtsigreturn restores the full PSTATE, letting an attacker clear the BTI transition type (BTYPE=0) and jump to arbitrary gadgets even with PAC and BTI both enabled. Presented at DEF C...