* Andrew Cooper: > The SYSCALL behaviour TLDR is: > > %rcx = %rip > %r11 = %eflags > %cs = fixed attr > %ss = fixed attr > %rip = MSR_LSTAR > > which means that %rcx (old rip) is the only piece of state which > userspace can't feasibly forge (and therefore could distinguish a > SYSCALL from user vs kernel mode), yet if we're talking about a JOP > chain to get here, then %rcx is under attacker control too.
Will the syscall handler do anything useful if called with an invalid system call number? If not, and if you can changed the FineIBT cookie register to %rax, would that address this particular gap? As long as the cookies do not overlap with valid system call numbers?
