Linux-kernel mailing list archive 1998-31,: Re: [Fwd: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds]

# Re: [Fwd: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds]

Joseph Malicki (jmalicki@clampton.com)
Sat, 08 Aug 1998 01:18:45 -0400

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Alex Buell: "HOWTO-framebuffer v0.13 released! :o)"
- Previous message: Ion Badulescu: "Re: problem with 114 sched.* changes (not the gcc one)"

Rene Janssen wrote:

> At 04:54 PM 8/6/98 -0400, you wrote:
> >IMPORTANT::
> >
> >Now, this leads to a way to have a truly secure system: an EXPAND-UP
> >STACK. With an expand up stack, where the ESP increments rather than
> >decrements on a push, you can not overwrite the return address with
> >the address of your own function.
>
> This doesnt save you from buffer underflows :
>
> void giant_bug(char *b)
> {
> char buf[256], *p=buf+256;
> int x;
> for (x=0;x<1024;++x) *p-- = *b++;
> }
>
> expand-up stacks are not secure either.

Thats not the point.... and thats not very common code either... the
point is an
intentional root exploit.... and to do that in an underflow, you are
checking for
size, and PROBABLY checking that against the size of the buffer....

Joseph Malicki

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

- Next message: Alex Buell: "HOWTO-framebuffer v0.13 released! :o)"
- Previous message: Ion Badulescu: "Re: problem with 114 sched.* changes (not the gcc one)"