[lkml]   [1997]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Non-executable stack patch

    On Sat, 7 Jun 1997, Solar Designer wrote:

    > BTW, I have just made a generic buffer overflow exploit using this method:
    > it does PTRACE_SINGLESTEP to find system() entry point, and then fills the
    > buffer with the following pattern: {system_addr, system_addr, string_addr,
    > string_addr} -- 4 int's (16 bytes) total. This is a bit more complicated
    > than what I was telling earlier (I forgot about the return address, which
    > we have to leave space for), but still requires at most two tries until it
    > works on an aligned buffer, and up to 8 tries on an unaligned one (which is
    > the case for /usr/bin/lpr that I was testing with).

    What about mapping libc always onto addresses that have a 0xab******
    pattern, and then forbidding character '0xab' in argv[] and envp[] strings
    [done by the kernel].

    this way it would be harder to generate a valid libc address via parameter
    overflow? [i'm assuming that the only open communication channel to get
    attack code into the process is argv[] and envp[]]

    Also, an attack warning could be issued if the kernel detects 'illegal'
    characters in parameter strings (for priviledged processes only). [how
    'illegal' is defined depends on locale settings]

    -- mingo

     \ /
      Last update: 2005-03-22 13:39    [W:0.018 / U:49.880 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site