INFRA Signal 404
Cleaning costs, or, examining the OpenBSD -fret-clean flag
↗
Illustration only Photo by Adrien on Unsplash
An academic evaluation of OpenBSD's -fret-clean flag argues the ROP mitigation costs more in binary size and runtime performance than it delivers in security value.
Engineers evaluating compiler-based security mitigations for production systems need empirical cost-benefit data, not just intuitive appeal. This independent research line suggests that zeroing return addresses or registers to thwart ROP has been repeatedly invented and repeatedly found not worth the overhead.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
OpenBSD's -fret-clean inserts a 9-byte instruction after every call to zero the return address slot, but only selectively enables it for kernel, libc, libcrypto, ld.so, and ssh binaries.
Similar mitigations (-fzero-call-used-regs, GCC's -mmitigate-rop) have been independently invented multiple times and later found ineffective or not worth the cost after empirical testing.
The author's research center has an upcoming IEEE paper with open science data showing the mitigation's costs outweigh its benefits.
THE CLUSTER