GNU C Library 2.43 đã chính thức ra mắt với việc bổ sung thêm các tính năng C23, cùng hai hàm mới: `mseal` và `openat2`. Bản cập nhật này cải thiện hiệu suất, bảo mật và khả năng tương thích hệ thống cho các ứng dụng C. Đây là bước tiến quan trọng cho các nhà phát triển hệ thống và phần mềm nguồn mở. #glibc #Cprogramming #C23 #openat2 #mseal #lậptrìnhC #GNU #phátriểnthệthống

https://www.reddit.com/r/programming/comments/1ql9c27/gnu_c_library_243_released_with_more_c23_features/

Modern CPUs support memory permissions such as RW and NX bits. The memory permission feature improves security stance on memory corruption bugs, i.e. the attacker can’t just write to arbitrary memory and point the code to it, the memory has to be marked with X bit, or else an exception will happen.

#Memory #sealing additionally protects the mapping itself against modifications. This is useful to mitigate memory corruption issues where a corrupted pointer is passed to a memory management system. For example, such an attacker primitive can break control-flow integrity guarantees since read-only memory that is supposed to be trusted can become writable or .text pages can get remapped. Memory sealing can automatically be applied by the runtime loader to seal .text and .rodata pages and applications can additionally seal security critical data at runtime.

A similar feature already exists in the XNU kernel with the VM_FLAGS_PERMANENT flag [1] and on OpenBSD with the mimmutable syscall [2].

#Linux #Kernel #Security #mseal

https://docs.kernel.org/userspace-api/mseal.html

Trail of Bits dives deep into Linux's new mseal syscall! 🔒🐧 Learn how this memory sealing feature enhances security by preventing illicit modifications during runtime. A must-read for #cybersecurity enthusiasts and #Linux developers! 🛡️💻 #mseal #ExploitMitigation

🔗 https://blog.trailofbits.com/2024/10/25/a-deep-dive-into-linuxs-new-mseal-syscall/

The new system call #mseal()[1] after multiple revisions and various discussions[2] finally made it to #linux-next and thus is slated to appear in #LinuxKernel 6.10:

https://lore.kernel.org/all/20240415163527.626541-1-jeffxu@chromium.org/T/#u

[1] "In a nutshell, mseal() protects the VMAs of a given virtual memory range against modifications, such as changes to their permission bits."

[2] https://lwn.net/Articles/948129/