3 ms·
I don't know the details, but a fully attacker controlled EIP sounds likely to be exploitable doesn't it? Possibly data leakage from the browser, maybe arbitrar
by ximeng 16y ago
I don't know the details, but a fully attacker controlled EIP sounds likely to be exploitable doesn't it? Possibly data leakage from the browser, maybe arbitrary execution if the attacker is lucky. This sounds likely at the least to put an attacker in a better place to socially engineer a user into installing malware.
- daeken 16y agoIf you can control EIP, you can run arbitrary code, period. It might be difficult depending on whether ASLR is in use or not, but it can always be done.
- ximeng 16y agoDoesn't this assume you can get the code you want to execute into memory? And that the page it ends up in is marked as executable?
- daeken 16y agoShort answer: No Long answer: It depends on what you define as arbitrary code execution. In a good number of cases, you can use ROP to execute whatever "code" (made up of little bits of existing program code repurposed for your needs) you wish, and accomplish whatever you want to accomplish. In many cases, this is finding your "real" code and setting memory protection such that you can jump into it. In effect, if you have control over EIP, you've already owned the system; it might not be easy to do everything you want to do, but it's effectively always possible.
- ximeng 16y agoInteresting, thanks. According to Google, ROP is return-oriented programming, where you build up a program by jumping to near the end of existing executable subroutines. The control flow comes from corrupting the stack with a list of the addresses of this code. The example here: http://cseweb.ucsd.edu/~hovav/dist/sparc.pdf http://cseweb.ucsd.edu/~hovav/dist/sparc.pdf uses a stack overflow. I'm not sure how this would work with just an arbitrary EIP though. Seems to me you need a bit more than that.