Image: Intel
Intel has announced today that its experimental CET security feature will be first made available in the company’s upcoming Tiger Lake mobile CPUs.
Intel has been working on CET, which stands for Control-flow Enforcement Technology, since 2016, when it first published the first version of the CET specification.
As its name hints, CET deals with “control flow,” a technical term used to describe the order in which operations are executed inside the CPU.
Malware that runs on a device can use vulnerabilities in other apps to hijack their control flow, and insert its malicious code to run in the context of another app.
On Intel’s future Tiger Lake mobile CPUs, CET will protect the control flow via two new security mechanisms, namely shadow stack, and indirect branch tracking.
Shadow stack refers to making a copy of an app’s intended control flow, storing the shadow stack in a secure area of the CPU, and using it to ensure no unauthorized changes take place in an app’s intended execution order.
Intel says the CET shadow stack will protect users a technique called Return Oriented Programming (ROP), where malware abuses the RET (return) instruction to append its malicious code to a legitimate app’s control flow.
On the other hand, indirect branch tracking refers to restricting and adding additional protections to an application’s ability to use CPU “jump tables,” which are tables containing memory locations (re)used across an app’s control flow.
Intel says indirect branch tracking protects against two techniques called Jump Oriented Programming (JOP) and Call Oriented Programming (COP), where malware abuses the JMP (jump) or CALL instructions to hijack a legitimate app’s jump tables.
Image: Intel
Because Intel published the CET specification back in 2016, software makers have had time to adjust their code for the first series of Intel CPUs that will support it.
CET support has already made it into Glibc, and Microsoft has also added CET support to Windows Insiders, as a feature called Hardware-enforced Stack Protection.
All that’s needed now is that Intel ships CPUs that support CET instructions, so apps and operating systems can activate support and opt-in for the protection CET provides.
CET launched today for Intel’s line of mobile CPUs that use the Tiger Lake microarchitecture, but the technology will also be available in desktop and server platforms, Tom Garrison, vice president of the Client Computing Group and general manager of Security Strategies and Initiatives (SSI) at Intel Corporation said today.
