Securing GCC and GLIBC
recording made private on YouTubehttps://youtu.be/b1fO-RLtDME
summary
GCC adds incremental prevention features: buffer bounds checking (improving since GCC 9), object-size detection, new static analyzers in GCC 10 and sanitizers (UBSan) shared with LLVM, and compiler plugins that record compilation metadata (anabin with anacheck) so builds can be audited for flags like fortify and optimization. glibc adds header access annotations, fortify_source=3 (glibc 2.33) and removed some malloc exploit primitives (2.34). Hardware CFI (Intel CET, ARM PAC/BTI) and function-pointer obfuscation plugins are in use for mitigation.
AI-written summary · about
related talks
44mWhere are we on security features?
42mDefending the Branch: PAC, BTI & GCS on Linux
34mMaking C Less Dangerous
21mSecurity Features status update
01h 34mSecurity in C++ - Hardening Techniques From the Trenches
18mExciting new compiler flags for kernel security
01h 05mSecurity in C++: Hardening techniques from the trenches
58mKeynote: Safety and Security: The Future of C and C++