"Exec Shield", new Linux security feature
Quoted 4 lines
There is another issue: x86 uses relative jumps, so although "ASCII armor" addresses aren't easily accessible using return address smashes (although the \0 at the end thing is a real issue), you may be able to get to them through a jump instruction.
Does the instruction-pointer-relative data addressing mode added by
AMD64 make these exploits easier? Maybe someone should be working on a version of this patch for that platform...
Quoted 9 lines · Chuck Ebbert
Quoted 4 lines
There is another issue: x86 uses relative jumps, so although "ASCII armor" addresses aren't easily accessible using return address smashes (although the \0 at the end thing is a real issue), you may be able to get to them through a jump instruction.
Does the instruction-pointer-relative data addressing mode added by
AMD64 make these exploits easier? Maybe someone should be working on a version of this patch for that platform...
No, they don't, not if your mode of exploit is hacking return addresses on the stack.
AMD64 makes this pretty easy, *ALL* user-space addresses are in the "ASCII armour" area, and it supports exec-off. Apparently this is currently off by default, but Andi Kleen says that they have identified the bug that caused it and they're making it available as a kernel option.
-hpa