Messages in this thread | | | Date | Thu, 30 Dec 1999 22:24:51 -0500 | From | "Theodore Y. Ts'o" <> | Subject | Re: Unexecutable Stack / Buffer Overflow Exploits... |
| |
Date: Thu, 30 Dec 1999 18:21:34 -0800 (PST) From: Dan Hollis <goemon@sasami.anime.net>
Youre talking about stackguard right? I guess the problem here is that noone has ported stackguard to egcs yet. Would be nice though.
No, I wasn't talking just about stackguard; other techniques do exist:
* arranging so that the stack pointer contains a 0x00 byte to make it harder for null-terminated strings to be used to write a valid return address
* at program start time, randomly changing the starting point of the stack by a few hundred kilbytes. (Since the starting location is changing randomly for every program invocation, guesses based on one process doesn't help eliminate possible guesses on another process.)
* have libc do stack frame analysis, and then have certain functions (sprintf, memcpy, strcpy, etc.) not allow operations which overwrite stack frame boundaries.
Both stackguard and the last option requires some CPU overhead at run-time; the first two don't require any overhead at all. Note that some of approaches, such as changing the stack location randomly will stop certain attacks that the Solar Designer patch won't catch.
- Ted
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |