Difference between revisions of "Exploit Methods/Function pointer overwrite"

From Linux Kernel Security Subsystem
Jump to navigation Jump to search
(Created page with "= Details = When an attacker has a write primitive, they can start function pointers to redirect execution. Function pointers exist in a large number of places in the kernel r...")
 
Line 1: Line 1:
= Details =
= Details =
When an attacker has a write primitive, they can start function pointers to redirect execution. Function pointers exist in a large number of places in the kernel ranging from function pointer tables (e.g. fops), to vector and descriptor tables.
When an attacker has a write primitive, they can overwrite function pointers to redirect execution. Function pointers exist in a large number of places in the kernel ranging from function pointer tables (e.g. fops), to vector and descriptor tables.


= Examples =
= Examples =

Revision as of 16:11, 14 September 2016

Details

When an attacker has a write primitive, they can overwrite function pointers to redirect execution. Function pointers exist in a large number of places in the kernel ranging from function pointer tables (e.g. fops), to vector and descriptor tables.

Examples

Mitigations

  • make function pointer tables read-only (e.g. PAX_CONSTIFY_PLUGIN)
  • make sensitive targets that need only occasional updates only writable during updates (e.g. PAX_KERNEXEC)