Security Features status update
summary
GCC, Clang, and Rust reach concrete parity on several items: per-thread stack protector guard locations are implemented across RISC-V, PowerPC and s390, and the counted_by attribute now covers pointer members with kernel-side packaging still catching up. Clang lands kcfi hash salt and sanitizer stack callbacks; GCC adds richer -Warray-bounds diagnostics and value-range context. Ongoing work: Clang’s -fbounds-safety and overflow-behavior types, KCFI forward-edge present in Rust, while inline hashing (GCC V9) advances; LTO and backward-edge CFI remain stalled.
AI-written summary · about
chapters (8)
- 0:00Introduction and overview
- 1:04Stack protector progress update
- 2:09Cross-language attack defenses
- 3:12Counted by attribute status
- 7:05Overflow behavior types
- 9:10Miscellaneous security features
- 13:43Bounds safety in Clang
- 14:46Q&A and future priorities
related talks
54mSecurity Features status update
44mWhere are we on security features?
01h 34mA Little Introduction to Control Flow Integrity in C++
58mKeynote: Safety and Security: The Future of C and C++
35mControl Flow Integrity on RISC-V Linux
41mRISC-V Control-Flow Integrity (CFI)
35mUpstream Kernel Hardening: Recent Progress and Challenges
52mKernel Hardening: Ten Years Deep