I have been learning about using stack overflows to get arbitrary code execution, one of the tricks used is overwriting the return address to make control flow go the way you want it. Assuming our system has NX bit.

What if we made the CPU instruction set require a "landing pad" instruction for any location that it ret or jmps to?

The idea is that a program would terminate with some kind of error if it jumps to a non landing pad instruction.

Would this stop the ability to make ROP gadgets? Do you think this ISA would be a lot more secure? Has the idea been tried in the past?

  • are you asking about the effectiveness of something like LandHere? – julian May 7 '17 at 17:40
  • It is difficult to evaluate the benefits of such a system without an objective standard or definition of security. I do not know if such a standard or definition exists, so your question "Do you think this ISA would be a lot more secure?" may not be answerable. – julian May 7 '17 at 18:08
  • 1
    You may want to look into Intel's CET, which essentially does this. It's basically CFG but in hardware, and using a shadow stack. – forest Dec 19 '17 at 4:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.