3 ms·
As has been pointed out on the LWN thread, buffer overflows even on the stack can also leave you vulnerable by overwriting other automatic variables, e.g. a var
by nhaehnle 13y ago
As has been pointed out on the LWN thread, buffer overflows even on the stack can also leave you vulnerable by overwriting other automatic variables, e.g. a variable that indicates whether a client is authenticated as an administrator.
- willvarfar 13y agoYes this is completely true. I meant particularly the return-to-libc type of attacks that the canary (to some extent) protects against, when I claimed immunity (and improved performance). We have some stuff to talk about on the protecting authentication flags and things front too, but I'm afraid that'll have to wait for the Security talk. One other security-related aspect that we have already presented is how stack debris is not readable once returned, so malicious code can't go looking at it. We've also talked a little bit about how we don't have rings, and we have very cheap syscalls across protection boundaries. So there are some hints of stuff to come.
- mparlane 13y agoROP chains.
- emillon 13y agoOn the conceptual level, ROP and return into libc are the same thing. You need to start them by overwriting an address somewhere, and the return address is a natural candidate.
- willvarfar 13y agoYes, the Security talk will cover ROP too :). Stay tuned. The Mill is far from exploit-free, but vast swathes of attacks can be stopped or mitigated and we do our best.