Skip to content

Discourage use of -mmitigate-rop in C and C++ Compiler Hardening GuideΒ #589

@thomasnyman

Description

@thomasnyman

Splitting this off from Dominik Czarnota's extensive feedback in #330.

The -mmitigate-rop option was introduced around GCC 6 and later deprecated in 2018 in favor of control-flow protection.

The idea behind -mmitigate-rop was to avoiding certain opcodes that may inadvertently encode a return instruction in the instruction stream. It did it using two strategies: renaming entire chains of registers, or inserting extra register to register copies if there a free scratch register is available.

Overall benefit of -mmitigare-rop was weak and control-flow protection in modern compilers and hardware offer better (but not complete) protection.

Resources:

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions