lkml.org 
[lkml]   [2004]   [Jun]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: WINE + NX (No eXecute) support for x86, 2.6.7-rc2-bk2
    Date
    Robert White wrote:
    > You are missing the model:
    >
    > To enable executable stack/heap you would:
    >
    > if ((fd = open("/proc/self/NX",O_RDWR)) >= 0) {
    > write(fd,"1",1);
    > close(fd);
    > }
    >
    > (disabling would be symmetric with "0")
    >
    > Because this is a sequence of specific instructions (that shouldn't exist in the
    > default library to prevent stack return hack invocation) these instructions would
    > exist only in programs that want to be EX anyway.

    Even such a protection model (a sequence of 3 syscalls to enable or
    disable NX) can be easily bypassed by an attacker. The classic method
    of return-into-libc (with a small variation that I would call
    chained-returns-into-libc) still works.

    As other people already said on this list: the ability to disable NX
    is a *bad* thing for security.

    --
    Marc Bevand http://www.epita.fr/~bevand_m
    Computer Science School EPITA - System, Network and Security Dept.

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:03    [W:0.022 / U:31.956 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site