Intel releases new hardware-level security features CET: artifact-Intel-IT defense ROP vulnerability information

IT information ROP vulnerabilities in the past more than 10 years has been unable to eradicate stubborn type of vulnerability, because it satisfies the Turing complete vulnerability exploits, vendors, including Microsoft and Google have all attempted to destroy it, but the result has not been satisfactory until the PaX RAP appeared.

Intel hardware manufacturers are also now begin to exert in this regard, issued Control-flow Enforcement Technology (hereinafter referred to as CET), as in the x86 and x64 interface CFI implemented on the platform. Introduced new features such as tracking of the shadow stack and an indirect branch, solving the defects of Microsoft Forward-edge.

But now the CET is actually only Intel ROP the future protection of the prototype, the currently open document is not complete, but allows developers to see the kernel and compiler, and the future development of security applications, Intel may have more information in the future.

Intel发布全新硬件级安全特性CET：防御ROP漏洞神器 - Intel - IT资讯

IT资讯讯 ROP漏洞是过去10多年来一直无法根除的顽固型漏洞，因为它满足图灵完备的漏洞利用方式，包括微软和谷歌在内的厂商也都曾经尝试消灭它，但结果都不理想，直到PaX的RAP出现。

现在硬件厂商Intel也在这方面开始发力，发布了Control-flow Enforcement Technology（下称CET），作为在x86和x64平台上CFI实现的底层接口。引入了shadow stack和间接分支的跟踪等新功能，基本解决了之前微软Forward-edge的缺陷。

不过现在的CET实际上只是Intel未来ROP防护的雏形，目前公开的文档并不完整，但可以让开发者们看到内核与编译器和安全应用的未来发展，今后Intel可能还有更多信息公布。