Re: Solaris 7 x86 lpset exploit.

[mouse () RODENTS MONTREAL QC CA (der Mouse)]

> > Another possible way around it would be to cause gcc to keep part of
> > the stack in the data segment, out of what the kernel thinks of as
> > the stack, and have it do its trampolines there.  This runs into big
> > problems with setjmp and other nonlocal exits, and possibly with
> > signal handlers as well.

> You could handle that by having a frame pointer on the processor
> stack point into the function's executable stack frame (if it has
> one) on the trampoline stack, rather than having a permanent stack
> pointer into this space.  I don't think there would be any issues
> with this, unless you're trying to use setjmp/longjmp for coroutines
> or something perverse like that.

If you longjmp out, how do you free up the jumped-through frames on the
executable stack?  If you do it by using a contiguous executable stack
with an offset-style pointer into it, conceptually the way longjmp
deals with freeing ordinary stack frames, how do you deal with
overflow, without wasting large amounts of data segment space on
programs that don't need deep executable stacks?  If you do it with a
linked list of frame structures, how do you push frames on it without
risking either a corrupted stack or a lost frame in the presence of
longjmp out of a signal handler?  If you do it with something else,
well, what?

Someone else said - I don't have the quote handy - that modern gcc
calls mprotect() after setting up a trampoline.  The notion of doing a
*syscall* per entry to a routine that uses trampolines, even when the
system may not need it (may have the stack executable already), that
makes me shudder.  I trust this can be turned off at compile time?  I'd
really hate to have to dummy out mprotect() just to get minimally sane
call performance.  (Oh, and what gcc version is that?)

                                        der Mouse

                               mouse () rodents montreal qc ca
                     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B