lkml.org 
[lkml]   [1999]   [Dec]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Unexecutable Stack / Buffer Overflow Exploits...
   Date: Thu, 30 Dec 1999 18:21:34 -0800 (PST)
From: Dan Hollis <goemon@sasami.anime.net>

Youre talking about stackguard right? I guess the problem here is that
noone has ported stackguard to egcs yet. Would be nice though.

No, I wasn't talking just about stackguard; other techniques do exist:

* arranging so that the stack pointer contains a 0x00 byte to
make it harder for null-terminated strings to be used to
write a valid return address

* at program start time, randomly changing the starting point of
the stack by a few hundred kilbytes. (Since the starting
location is changing randomly for every program
invocation, guesses based on one process doesn't help
eliminate possible guesses on another process.)

* have libc do stack frame analysis, and then have certain
functions (sprintf, memcpy, strcpy, etc.) not allow
operations which overwrite stack frame boundaries.

Both stackguard and the last option requires some CPU overhead at
run-time; the first two don't require any overhead at all. Note that
some of approaches, such as changing the stack location randomly will
stop certain attacks that the Solar Designer patch won't catch.

- Ted

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.070 / U:0.444 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site