lkml.org 
[lkml]   [1997]   [Dec]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: two things

Andi Kleen writes:
> linux kernel account <linker@nightshade.z.ml.org> writes:

>> I want to point out that I have offered cash for someone to
>> find an exploit that still works with no-exec stack...

Since nobody collected, the patch is quite good.

>> Yes, it's still possible BUT very difficult. The hack must either
>> look like a trampolene or be in an app where a tram is occuring..
>
> Writing that exploit it pretty easy. You just have to guess the
> address of a
>
> exec("/bin/sh");
>
> code fragment in libc (e.g. in system()) or in the program itself.
> Then put this address on the stack and wait for the program to
> jump to it.

You'd think so, but some versions of the patch have a solution.
There are actually 2 solutions:

1. Randomize the stack and/or library location.
(and of course failed exploits get logged)

2. Map the library with a '\0' in the address.
It is impossible to get such an address past strcpy().

Anyway, this is an imperfect world. The patch is good.


\
 
 \ /
  Last update: 2005-03-22 13:40    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site