Bug Classes/Integer overflow - Revision history

KeesCook: /* Examples */

2016-03-09T21:47:12Z

Examples

← Older revision		Revision as of 21:47, 9 March 2016
Line 8:		Line 8:
	* [https://cyseclabs.com/page?n=02012016 group_info refcount overflow]		* [https://cyseclabs.com/page?n=02012016 group_info refcount overflow]
	* [http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/ keyring refcount overflow]		* [http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/ keyring refcount overflow]
			* [https://code.google.com/p/google-security-research/issues/detail?id=758 netfilter xt_alloc_table_info integer overflow]

	= Mitigations =		= Mitigations =

KeesCook: /* Examples */ paste-o

2016-02-03T21:02:41Z

Examples: paste-o

← Older revision		Revision as of 21:02, 3 February 2016
Line 6:		Line 6:

	* [https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/ slub overflow]		* [https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/ slub overflow]
	* [https://cyseclabs.com/page?n=02012016 refcount overflow]		* [https://cyseclabs.com/page?n=02012016 group_info refcount overflow]
	* [~~https~~://~~googleplex~~-~~android~~-~~review.git.corp.google.com~~/~~849547~~ refcount overflow]		* [http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/ keyring refcount overflow]

	= Mitigations =		= Mitigations =

KeesCook: /* Examples */

2016-01-21T20:18:15Z

Examples

← Older revision		Revision as of 20:18, 21 January 2016
Line 7:		Line 7:
	* [https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/ slub overflow]		* [https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/ slub overflow]
	* [https://cyseclabs.com/page?n=02012016 refcount overflow]		* [https://cyseclabs.com/page?n=02012016 refcount overflow]
			* [https://googleplex-android-review.git.corp.google.com/849547 refcount overflow]

	= Mitigations =		= Mitigations =

KeesCook: /* Examples */

2016-01-04T20:06:07Z

Examples

← Older revision		Revision as of 20:06, 4 January 2016
Line 6:		Line 6:

	* [https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/ slub overflow]		* [https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/ slub overflow]
			* [https://cyseclabs.com/page?n=02012016 refcount overflow]

	= Mitigations =		= Mitigations =

KeesCook: Created page with "= Details = Integer overflows (or underflows) occur when a multiplication happens that exceeds the size that can be represented by the datatype, generally wrapping around. Th..."

2015-11-04T22:02:37Z

Created page with "= Details = Integer overflows (or underflows) occur when a multiplication happens that exceeds the size that can be represented by the datatype, generally wrapping around. Th..."

New page

= Details =

Integer overflows (or underflows) occur when a multiplication happens that exceeds the size that can be represented by the datatype, generally wrapping around. This usually results in either writing to too-small buffers, or producing out of bound array indexes. Exploitation is most common via heap overflows, since the (too-small) buffers tend to be allocated on the heap. Additionally, reference counting can overflow and wrap around, leading to use-after-free exploits.

= Examples =

* [https://jon.oberheide.org/blog/2010/09/10/linux-kernel-can-slub-overflow/ slub overflow]

= Mitigations =

* check for refcount overflows (e.g. PAX_REFCOUNT)
* compiler instrumentation to detect multiplication overflows at runtime (e.g. [https://github.com/ephox-gcc-plugins PAX_SIZE_OVERFLOW])