lkml.org 
[lkml]   [1998]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds
On Tue, 4 Aug 1998, Linus Torvalds wrote:

> It's _really_ easy. You do something like this:
> - overflow the buffer on the stack, so that the return value is
> overwritten by a pointer to the "system()" library function.
> - the next four bytes are crap (a "return pointer" for the system call,
> which you don't care about)
> - the next four bytes are a pointer to some random place in the shared
> library again that contains the string "/bin/sh" (and yes, just do a
> strings on the thing and you'll find it).

Yeah, except that you'll fail.

libc is remapped by the patch so that the most significant byte of the
addresses are 0. Thus you're able to form exactly one libc address for
pretty much all string operations. That makes it a little more
challenging to set up the stack.

It's still possible, yes. And it's also possible to defeat a firewall.

64-bit folks could pull that trick even better by using only 56-bits of
addresses per process, and guaranteeing that some interior byte is always
zero.

Dean



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.075 / U:0.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site