A deep dive into Linux’s new mseal syscall

Summary: The mseal syscall landed in Linux kernel 6.10, letting developers seal virtual memory address ranges so an attacker with a code execution primitive cannot change their permissions or layout at runtime. Chrome's security team introduced it to support their V8 CFI strategy, initially for ChromeOS, and it is planned for integration into glibc possibly in version 2.41.
Key Takeaway: Memory sealing blocks the data-only techniques that survive CFI, including the hole-punching and House of Muney attacks that Qualys used for a real-world exploit of an ancient Qmail bug, and at present glibc will not seal the stack or heap automatically, leaving that decision to developers.

Read the original at Trail of Bits Blog ↗