4 ms·

Does this mean to successfully exploit a program I need to write to an area in memory that the program will later turn the page in memory to "Execute"?

by jtchang 10y ago

eugeneionesco 10y ago
Nope, just use return oriented programming.
- notaplumber 10y ago
  OpenBSD has ROP, SROP mitigations, everything is compiled PIE. Even invented a static PIE variant for single-user and install media.
  - eugeneionesco 10y ago
    All of those are pretty much useless since the vast majority of vulnerabilities can be used to read arbitrary memory.
PeCaN 10y ago
Yep! That's the idea here: it makes it less likely to accidentally treat data as instructions. If you can figure out some bug in a JIT compiler to get it to write your payload to a page that will get turned executable, then you still have an exploit, but the attack surface is smaller. You can try return-oriented programming, but OpenBSD makes that hard: the stack is never executable, everything is position independent, objects get shuffled around inside libraries and executables¹, maybe more. ¹ At least this was proposed, and I think it landed in one of the newer releases, but I can't seem to find it for sure.
- notaplumber 10y ago
  Yep: http://marc.info/?l=openbsd-cvs&m=146168291000757&w=2 http://marc.info/?l=openbsd-cvs&m=146168291000757&w=2
  - PeCaN 10y ago
    Thanks, that's exactly what I was thinking of. Does it re-link only libc on startup, or other libraries as well? Found the slide that I remembered: https://twitter.com/justincormack/status/577005049374601217 https://twitter.com/justincormack/status/577005049374601217 Do you know if any of the rest of that is in-progress or complete?
    - notaplumber 10y ago
      My observations.. * binutils 2.17 (last GPLv2) - complete. * all archs transitioned to pie - complete as of 5.7. * /sbin/init static pie - complete. * ROP gadgets are being hunted down systematically, many nop sleds changed to int3/illegal instr. * BROP - many base daemons now fork + exec, not all. * SROP - mitigation committed - complete? * shuffle - libc objects get shuffled at boot by rc(8), stack object order shuffling as a gcc extension. .. Progress continues.

Does this mean to successfully exploit a program I need to write to an area in memory that the program will later turn the page in memory to "Execute"?

by jtchang 10y ago

Does this mean to successfully exploit a program I need to write to an area in memory that the program will later turn the page in memory to "Execute"?

eugeneionesco 10y ago

Nope, just use return oriented programming.

notaplumber 10y ago
OpenBSD has ROP, SROP mitigations, everything is compiled PIE. Even invented a static PIE variant for single-user and install media.
- eugeneionesco 10y ago
  All of those are pretty much useless since the vast majority of vulnerabilities can be used to read arbitrary memory.

PeCaN 10y ago

Yep! That's the idea here: it makes it less likely to accidentally treat data as instructions. If you can figure out some bug in a JIT compiler to get it to write your payload to a page that will get turned executable, then you still have an exploit, but the attack surface is smaller. You can try return-oriented programming, but OpenBSD makes that hard: the stack is never executable, everything is position independent, objects get shuffled around inside libraries and executables¹, maybe more. ¹ At least this was proposed, and I think it landed in one of the newer releases, but I can't seem to find it for sure.

notaplumber 10y ago
Yep: http://marc.info/?l=openbsd-cvs&m=146168291000757&w=2 http://marc.info/?l=openbsd-cvs&m=146168291000757&w=2
- PeCaN 10y ago
  Thanks, that's exactly what I was thinking of. Does it re-link only libc on startup, or other libraries as well? Found the slide that I remembered: https://twitter.com/justincormack/status/577005049374601217 https://twitter.com/justincormack/status/577005049374601217 Do you know if any of the rest of that is in-progress or complete?
  - notaplumber 10y ago
    My observations.. * binutils 2.17 (last GPLv2) - complete. * all archs transitioned to pie - complete as of 5.7. * /sbin/init static pie - complete. * ROP gadgets are being hunted down systematically, many nop sleds changed to int3/illegal instr. * BROP - many base daemons now fork + exec, not all. * SROP - mitigation committed - complete? * shuffle - libc objects get shuffled at boot by rc(8), stack object order shuffling as a gcc extension. .. Progress continues.