Vulnerability Development mailing list archives
Re: stackguard-like embedded protection
From: antirez <antirez () linuxcare com>
Date: Wed, 6 Sep 2000 09:24:36 +0200
On Tue, Sep 05, 2000 at 01:44:57PM -0700, Greg KH wrote:
I know that StackGuard and ProPolice can't combat formation bugs, and I am guessing that libsafe and StackShield can't either (once you can write arbitrary data to any spot in memory, you can get around any of these protections.
Yes, anyway Stackguard-like protection maybe conceptually less strong in this context. Even if with some tricks both Stackguard-like and Stackshield-like can be defeating using the %n bug. <to simplify> In order to defeat the stackguard protection you can read the random number so you can spoof it. In order to defeat the stackshield protection you must _write_ the saved RET, so that they will match. Anyway it's a lot more simple to protect (with for example mprotect(2)) from writing that protect from reading. Unfortunatelly page alignment isn't our friend, and we must allocare a lot of memory in order to use mprotect. </to simplify> antirez -- Salvatore Sanfilippo, Open Source Developer, Linuxcare Italia spa +39.049.80 43 411 tel, +39.049.80 43 412 fax antirez () linuxcare com, http://www.linuxcare.com/ Linuxcare. Support for the revolution.
Current thread:
- stackguard-like embedded protection antirez (Sep 04)
- Re: stackguard-like embedded protection antirez (Sep 04)
- Re: stackguard-like embedded protection Bluefish (P.Magnusson) (Sep 05)
- Re: stackguard-like embedded protection Greg KH (Sep 05)
- Re: stackguard-like embedded protection antirez (Sep 06)
- Re: stackguard-like embedded protection Crispin Cowan (Sep 06)
- Re: stackguard-like embedded protection typo (Sep 05)
- Re: stackguard-like embedded protection Crispin Cowan (Sep 05)
- Re: stackguard-like embedded protection Benjamin Karas (Sep 05)
- Re: stackguard-like embedded protection Bluefish (P.Magnusson) (Sep 05)
- Re: stackguard-like embedded protection Greg KH (Sep 05)
- Re: stackguard-like embedded protection Juliano Rizzo (Sep 06)
- Re: stackguard-like embedded protection Bluefish (P.Magnusson) (Sep 05)
- Re: stackguard-like embedded protection Crispin Cowan (Sep 05)
- Re: stackguard-like embedded protection H D Moore (Sep 05)
- Re: stackguard-like embedded protection Crispin Cowan (Sep 06)
- Re: stackguard-like embedded protection antirez (Sep 04)