2 ms·
"Another benefit is that it requires unique methodology for OpenBSD, which requirements investment." Secure in the absence of an attacker? This part: xx:
by marshray 3y ago
"Another benefit is that it requires unique methodology for OpenBSD, which
requirements investment."
Secure in the absence of an attacker?
This part:
xx: b8 05 00 00 00 mov $0x5,%eax
xx: 0f 05 syscall
This means "perform operation #5, which is open(2)"
Inside the kernel, we know the system call # and the address of
the syscall instruction.
Why can't the attacker just jump to an existing syscall instruction? Maybe one followed soon by a return.
4) in libc.so's table, all the system call stub "syscall instructions"
are registered.
I don't know a lot about binary exploitation techniques. Is all this entirely reliant on layout randomization?
- projektfu 3y agoYeah, but the memory shouldn't be readable, so it's harder to find the random location to jump to. There's a bit of circular discussion, where Theo/Open BSD devs say they're introducing feature F to reduce an exploit, and people criticize it as being irrelevant because you can do other exploits, but they've already implemented A,B,C,D and E to handle those, and for each of those individual features there's a list of exploits that get around them, but maybe not if all are implemented. A more rigorous analysis of the security environment as a whole would be useful.