3 ms·
>CacheOut violates the operating system's privacy by extracting information from it that facilitates other attacks, such as buffer overflow attacks. >More spec
by scandinavian 7y ago
>CacheOut violates the operating system's privacy by extracting information from it that facilitates other attacks, such as buffer overflow attacks.
>More specifically, modern operating systems employ Kernel Address Space Layout Randomization (KASLR) and stack canaries. KASLR randomizes the location of the data structures and code used by the operating system, such that the location is unknown to an attacker. Stack canaries put secret values on the stack to detect whether an attacker has tampered with the stack. CacheOut extracts this information from the operating system, essentially enabling full exploitation via other software attacks, such such as buffer overflow attacks.
Can anyone explain this scenario? Is this really a realistic scenario? Do they mean if you have code execution on a system, and want to escalate privileges, you would find another network/socket service that is running on the same system, find an exploit in this service, and then leak the stack canary to allow corrupting the stack? There's often easier ways to defeat the stack canary.
- loeg 7y agoYes, it's a local privilege escalation issue, i.e. you must have local code execution first. Leaking KASLR/stack canary just mean you get 90s level triviality of attacking any stack-overflowing API you can find. Without this bug, if you found a stack-overflow you could trigger from your local unprivileged code, the target would likely detect the overflow due to the canary. If you defeated that mechanism, constructing shellcode might be more difficult due to (K)ASLR. With this bug, neither stack canaries nor (K)ASLR are effective defenses against unprivileged programs.
- scandinavian 7y agoSure, I was just kinda confused that this was the example they presented. I guess for highly targeted attacks, it might be somewhat useful. >Leaking KASLR/stack canary just mean you get 90s level triviality of attacking any stack-overflowing API you can find. It does not seem trivial with this exploit, but maybe I'm just not getting it. With the low accuracy and transfer rate, it seems like a lot of stars need to line up with regards to how the service you attack function.