Skip to content

Can a valid ENDBRANCH instruction be longer than 4 bytes? #276

@tremalrik

Description

@tremalrik

Taking a look at the endbr64 instruction, its encoding is listed in the SDM as F3 0F 1E FA. From what I can find, most discussion around this instruction seems to assume exactly this 4-byte sequence and how to construct - or prevent the construction of - gadgets containing this exact sequence. However, given that the instruction is composed of a mandatory F3 prefix followed by a specific long-NOP enocding, a question arises of whether the instruction remains a valid CET end-branch instruction if more prefixes are added. If so, there seems to be a possible security issue in that it becomes possible to create an endbr64 instruction/gadget that does not contain the exact 4-byte sequence F3 0F 1E FA.

For a specific example, consider the encoding F3 3E 0F 1E FA (that adds a useless DS prefix). Should this encoding be recognized as a valid endbr64 instruction? (xed -64 -cet -d F3 3E 0F 1E FA currently recognizes it as such.)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions