Linux-kernel mailing list archive 1998-31,: Foot-in-mouth: Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2

# Foot-in-mouth: Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2

Joseph Malicki (jmalicki@clampton.com)
Thu, 06 Aug 1998 17:37:15 -0400

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Jiann-Ming Su: "sx164 floppy solution (fwd)"
- Previous message: Brandon S. Allbery KF8NH: "Re: what is a .pax file ?"

Joseph Malicki wrote:

>
>
>
> IMPORTANT::
>
> Now, this leads to a way to have a truly secure system: an EXPAND-UP
> STACK. With an expand up stack, where the ESP increments rather than
> decrements on a push, you can not overwrite the return address with
> the address of your own function. This could probably be implementable
> as an ELF flag, or maybe as a separate "architecture" with its own set
> of compiled libraries (as the current system would not work, since you
> would be calling a library that uses an expand-down stack). The
> Intel architecture, at least, allows you to specify an expand-up
> stack via the descriptor table segment type flag by setting it up
> like a normal data segment.
>
> This may not be extremely feasible, but for firewalls etc. where Alan
> recommends the patch, there could be distributions built that use
> an expand-up stack, which basically eliminates the current
> system of buffer overflows, completely closing a hole that has been
> in existance since 1988.
>

Oops! I just realized that the expand-down vs. expand-up has
absolutely nothing to do with the way the ESP register works...
but this makes me wonder if such a stack is available on any
architectures? Hmm... sorry for wasting bandwidth, but
IMHO this would be a very good solution to the problem if it
is available on any architectures

Joseph Malicki

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

- Next message: Jiann-Ming Su: "sx164 floppy solution (fwd)"
- Previous message: Brandon S. Allbery KF8NH: "Re: what is a .pax file ?"