Bug Classes/Stack overflow - Revision history

KeesCook at 21:48, 4 November 2015

2015-11-04T21:48:07Z

← Older revision		Revision as of 21:48, 4 November 2015
Line 1:		Line 1:
	= Details =		= Details =

	The traditional bug results in the stack buffer being written past the end of the stack frame, which allows the saved instruction pointer to be overwritten in order to gain execution control ("stack buffer overflow"). A stack depth overflow bug is when the size of the stack grows past its maximal size (via deep call stacks or via alloca abuse), and allows writing on other stacks or threadinfo. Other attacks could stay within the stack frame, manipulating local variables ("data only" attacks), and some attacks allow for writing by arbitrary offsets between kernel stacks.		The traditional bug results in the stack buffer being written past the end of the stack frame, which allows the saved instruction pointer to be overwritten in order to gain execution control ("stack buffer overflow"). A stack depth overflow bug is when the size of the stack grows past its maximal size (via deep call stacks or via alloca abuse), and allows writing on other stacks or threadinfo. Other attacks could stay within the stack frame, manipulating local variables ("data only" attacks), and some attacks allow for writing by arbitrary offsets between kernel stacks.

KeesCook: /* Details */

2015-11-04T21:47:09Z

Details

← Older revision		Revision as of 21:47, 4 November 2015
Line 1:		Line 1:
	= Details =		= Details =
	The traditional bug results in the stack buffer being written past the end of the stack frame, which allows the saved instruction pointer to be overwritten in order to gain execution control. Other attacks could stay within the stack frame, manipulating local variables ("data only" attacks)~~. Some~~ attacks allow for arbitrary offsets between kernel stacks ~~to be written~~.		The traditional bug results in the stack buffer being written past the end of the stack frame, which allows the saved instruction pointer to be overwritten in order to gain execution control ("stack buffer overflow"). A stack depth overflow bug is when the size of the stack grows past its maximal size (via deep call stacks or via alloca abuse), and allows writing on other stacks or threadinfo. Other attacks could stay within the stack frame, manipulating local variables ("data only" attacks), and some attacks allow for writing by arbitrary offsets between kernel stacks.

	= Examples =		= Examples =

KeesCook: /* Mitigations */

2015-11-04T21:44:26Z

Mitigations

← Older revision		Revision as of 21:44, 4 November 2015
Line 9:		Line 9:

	* stack canaries (e.g. gcc's -fstack-protector and [https://git.kernel.org/linus/8779657d29c0ebcc0c94ede4df2f497baf1b563f -fstack-protector-strong])		* stack canaries (e.g. gcc's -fstack-protector and [https://git.kernel.org/linus/8779657d29c0ebcc0c94ede4df2f497baf1b563f -fstack-protector-strong])
			* guard pages (e.g. GRKERNSEC_KSTACKOVERFLOW)
			* alloca checking (e.g. PAX_MEMORY_STACKLEAK)
	* kernel stack location randomization		* kernel stack location randomization
	* shadow stacks		* shadow stacks

KeesCook at 21:35, 4 November 2015

2015-11-04T21:35:47Z

← Older revision		Revision as of 21:35, 4 November 2015
Line 4:		Line 4:
	= Examples =		= Examples =

	* [https://jon.oberheide.org/files/half-nelson.c half-nelson.c] This uses stack offsets, rather than the traditional buffer overflow.		* [https://jon.oberheide.org/files/half-nelson.c half-nelson.c] This uses stack offsets, rather than the traditional buffer overflow.

	= Mitigations =		= Mitigations =

	* stack canaries (e.g. gcc's -fstack-protector and -fstack-protector-strong)		* stack canaries (e.g. gcc's -fstack-protector and [https://git.kernel.org/linus/8779657d29c0ebcc0c94ede4df2f497baf1b563f -fstack-protector-strong])
	* kernel stack location randomization		* kernel stack location randomization
	* shadow stacks		* shadow stacks

KeesCook: Created page with "= Details = The traditional bug results in the stack buffer being written past the end of the stack frame, which allows the saved instruction pointer to be overwritten in orde..."

2015-11-04T21:33:39Z

Created page with "= Details = The traditional bug results in the stack buffer being written past the end of the stack frame, which allows the saved instruction pointer to be overwritten in orde..."

New page

= Details =
The traditional bug results in the stack buffer being written past the end of the stack frame, which allows the saved instruction pointer to be overwritten in order to gain execution control. Other attacks could stay within the stack frame, manipulating local variables ("data only" attacks). Some attacks allow for arbitrary offsets between kernel stacks to be written.

= Examples =

* [https://jon.oberheide.org/files/half-nelson.c half-nelson.c] This uses stack offsets, rather than the traditional buffer overflow.

= Mitigations =

* stack canaries (e.g. gcc's -fstack-protector and -fstack-protector-strong)
* kernel stack location randomization
* shadow stacks