[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSZLFYsHCJw7XDeGpwsW65Wt56h9fcLCEVf9cE90ouXg":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":35,"sourceUrl":36,"status":37,"seoTitle":7,"seoDescription":9,"canonicalUrl":38,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"9f17ad58-5218-4b36-8a58-584b1e6020e1","article","PAC：处理器如何识破被动过手脚的指针？","arm-pointer-authentication-pac-explained","Pointer Authentication 用秘密密钥和上下文信息为指针生成校验码，使用前再验证，帮助缓解部分指针篡改与控制流攻击。它不是加密，也不能代替内存安全；本文用“带封签的地址”解释 PAC 的保护范围。","程序里的指针通常只是一个地址，但在安全敏感的代码中，“知道地址”还不够：如果攻击者能悄悄把它改成另一个位置，程序可能跳去执行不该执行的代码。Arm 的 Pointer Authentication（PAC，指针认证）为指针增加一层校验，让处理器在关键使用点检查它是否被篡改。\n\n## 给地址加一枚带上下文的封签\n\nPAC 的直觉可以理解为给文件封口：程序使用秘密密钥、指针值以及上下文信息，计算出一小段认证码，并把它放进指针可用的位域中。需要使用指针时，处理器再根据相同密钥和上下文验证认证码。若地址被改动，或指针被放到了不匹配的上下文里，验证便可能失败，进而让程序异常，而不是悄悄按被篡改的地址继续执行。\n\n上下文很重要。一个返回地址、函数指针或数据指针，可能采用不同的签名方式或修饰值。只有在程序对相应位置做了签名，并在使用时执行认证，PAC 才能发挥预期作用。它常被用于保护返回地址等控制流关键数据，降低某些利用内存破坏漏洞进行代码重定向的难度。\n\n## PAC 不是加密，也不是万能护盾\n\n认证码的用途是“发现不匹配”，不是隐藏地址内容。PAC 不会把指针变成只有持钥者才能读懂的密文，也不会自动修复造成指针被覆盖的越界写。若攻击者找到可重用的合法指针、绕过签名点，或利用未受保护的数据，系统仍可能遭受攻击。实际保护还取决于密钥管理、编译器插桩、操作系统配置和软件代码路径。\n\n它也容易和代码签名混为一谈。应用代码签名通常用于判断一个软件包是否来自可信发布者、内容是否被改过；PAC 则是运行时对进程中的指针做认证，两者保护对象和时间点都不同。名字里都有“认证”，但解决的问题并不一样。\n\n因此，PAC 最适合被理解为控制流防护中的一道硬件辅助检查：指针在关键位置使用前先验封签。它能提高篡改指针的成本，却不能替代边界检查、内存安全语言、沙箱和漏洞修复。安全设计不应只问“硬件开没开”，还要问关键指针是否真正经过了签名与验证。\n\n来源：[Arm Learning Paths：Pointer Authentication](https:\u002F\u002Flearn.arm.com\u002Flearning-paths\u002Fservers-and-cloud-computing\u002Fpac\u002Fpac\u002F)","\u002Fuploads\u002F2026-10-17\u002Fd41b36cc-e486-480a-ad5d-b734d6e9991e.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"8d35e42e-9f5b-4dd9-b30f-dc2c53d06096","硬件","hardware",{"id":32,"name":33,"slug":34},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev","Arm Learning Paths","https:\u002F\u002Flearn.arm.com\u002Flearning-paths\u002Fservers-and-cloud-computing\u002Fpac\u002Fpac\u002F","published",null,false,53,0,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:29.487Z",[45,54,62],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"5f2d281d-4673-42f3-b5e4-4cc68974abc6","SR-IOV：一张实体网卡怎样变成多个可分配给虚拟机的设备？","sriov-pci-device-virtual-functions","SR-IOV 允许支持该能力的 PCIe 设备由物理功能创建多个虚拟功能，供不同工作负载更直接地使用。本文解释 PF\u002FVF 分工、性能价值，以及为什么硬件虚拟化本身不等于完整隔离。","\u002Fuploads\u002F2026-10-13\u002F8b63e99b-a5e9-4f90-bbdb-81b28a2a38be.jpg",44,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:46.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":42,"createdAt":61},"ccf00154-c4a8-4439-a8e8-4151b1c20721","AF_XDP：Linux 怎样把高速网卡数据直接交给用户程序？","linux-af-xdp-fast-packet-path","AF_XDP 是 Linux 面向高性能收发包的套接字接口，可把 XDP 处理后的数据送入用户态环形队列。本文从网卡、缓冲区和队列讲清数据路径，并说明所谓零拷贝依赖驱动与硬件支持。","\u002Fuploads\u002F2026-10-17\u002Ffdcc8edb-927f-41dc-8802-1e9053c47bfa.jpg",45,"2026-10-17T03:08:33.177Z",{"id":63,"type":6,"title":64,"slug":65,"summary":66,"coverUrl":67,"authorName":14,"sno":68,"publishedAt":52,"createdAt":69},"2ff97b85-3142-4a75-924f-e6afa339d700","NVMe ZNS：为什么有些 SSD 要求数据按区域顺序写？","nvme-zns-zoned-namespace","ZNS 把 SSD 命名空间划分为必须顺序写入的区域，让主机参与闪存数据布局与回收。本文解释这种分工如何减少无效搬运，也说明它给文件系统和应用带来的管理成本。","\u002Fuploads\u002F2026-10-13\u002Fd2d45247-533f-4b02-b1a8-56f14d1dade3.jpg",46,"2026-10-13T02:13:43.485Z"]