FineIBT Enhanced: Hardening Linux’s Microarchitectural Security on X86
summary
FineIBT enhanced as FineIBT+ BHI injects 32-bit type hashes at indirect call sites and uses cmove sequences to poison live registers on a hash mismatch, preventing speculative gadgets from receiving attacker-controlled arguments. Compiler (Clang/KCFI) support records arity; per-kernel type space is ~11,000 types with expected hash collisions ≈0.01. Implementation lands in Linux 6.15, uses tiny per-arity stubs when needed, and measures show negligible overhead (typically <2%, often <1%) across modern x86 microarchitectures.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:44Disclaimers
- 2:05Call-oriented programming risks
- 5:38Spectre vulnerabilities
- 15:57Indirect Branch Tracking
- 20:57FineIBT solution
- 25:16Mitigating vulnerabilities
- 35:39Implementation challenges
- 39:56Performance benchmarks
- 42:48Future work
- 47:06Q&A
related talks
44mLinux Kernel Control-Flow Integrity Sup...
38mTaking Kernel Hardening to the Next Level
29mA Technical Deep Dive Into Intel CET Implementation in Linux
52mKernel Hardening: Ten Years Deep
27mFiner-grained kernel control flow integrity and challenges
39mControl Flow Integrity in the Linux Kernel
35mUpstream Kernel Hardening: Recent Progress and Challenges
35mControl Flow Integrity on RISC-V Linux