Cleaning costs, or, examining the OpenBSD -fret-clean flag
Summary
The blog analyzes OpenBSD's -fret-clean mitigation, detailing how the compiler inserts a zeroing move after function returns to hinder ROP. It presents empirical measurements across OpenBSD/FreeBSD ports, showing modest to moderate performance costs and a limited reduction in attacker-recoverable libc pointers, arguing that such intuitive mitigations may not justify their costs. The author urges more rigorous, transparent empirical evaluation of mitigations and suggests defense-in-depth as a more nuanced approach.