Linux-kernel mailing list archive 1998-31,: Re: [Fwd: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds]

# Re: [Fwd: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds]

Kragen (kragen@pobox.com)
Fri, 7 Aug 1998 09:59:17 -0400 (EDT)

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Somnath Roy: "Problem with ping with DE500 Ethernet adapter"
- Previous message: Achim Leubner: "A problem with SMP"
- In reply to: Rene Janssen: "Re: [Fwd: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2"

On Fri, 7 Aug 1998, Rene Janssen wrote:
> At 04:54 PM 8/6/98 -0400, you wrote:
> >IMPORTANT::
> >
> >Now, this leads to a way to have a truly secure system: an EXPAND-UP
> >STACK.

This is a foolish statement. As long as minor programming bugs result
in attackers being able to overwrite arbitrary memory, you don't have a
"truly secure system".

> >With an expand up stack, where the ESP increments rather than
> >decrements on a push,

Methinks thou art not well-versed in the ways of Intel iAPX86 assembly.

> This doesnt save you from buffer underflows :
> void giant_bug(char *b)
> {
> char buf[256], *p=buf+256;
> int x;
> for (x=0;x<1024;++x) *p-- = *b++;
> }
>
> expand-up stacks are not secure either.

I suspect that this kind of bug is three or four orders of magnitude
less common than the traditional buffer overflow, though.

Kragen

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

- Next message: Somnath Roy: "Problem with ping with DE500 Ethernet adapter"
- Previous message: Achim Leubner: "A problem with SMP"
- In reply to: Rene Janssen: "Re: [Fwd: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2"