Messages in this thread | | | Date | Tue, 4 Aug 1998 14:43:15 -0700 (PDT) | From | dgaudet-list-linux-kernel@arctic ... | Subject | Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds |
| |
On Tue, 4 Aug 1998, Linus Torvalds wrote:
> It's _really_ easy. You do something like this: > - overflow the buffer on the stack, so that the return value is > overwritten by a pointer to the "system()" library function. > - the next four bytes are crap (a "return pointer" for the system call, > which you don't care about) > - the next four bytes are a pointer to some random place in the shared > library again that contains the string "/bin/sh" (and yes, just do a > strings on the thing and you'll find it).
Yeah, except that you'll fail.
libc is remapped by the patch so that the most significant byte of the addresses are 0. Thus you're able to form exactly one libc address for pretty much all string operations. That makes it a little more challenging to set up the stack.
It's still possible, yes. And it's also possible to defeat a firewall.
64-bit folks could pull that trick even better by using only 56-bits of addresses per process, and guaranteeing that some interior byte is always zero.
Dean
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html
| |