Linux-kernel mailing list archive 2000-23,: Re: OS stopping stack buffer overflow exploits

# Re: OS stopping stack buffer overflow exploits

Matthew Dharm (mdharm-kernel@one-eyed-alien.net)
Sat, 3 Jun 2000 19:48:17 -0700

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Jason: "PPro Bug Fix"
- Previous message: Luke Reeves: "Re: Linux 2.5 / 2.6 TODO (preliminary)"

On Sat, Jun 03, 2000 at 09:06:46PM -0500, Robert Redelmeier wrote:
> 2) On syscall entry, the kernel could check the page tables
> to be sure that the return address is from code pages (read-only),
> and not from data pages (read-write). The kernel would log and
> terminate any such process. Kill some nasty bugs this way too.
> This assumes an exploit can do limited damage without syscalls.

Hrm... this could cause some problems for applications which use
self-modifying code (i.e. trampoline handlers, etc.)

Matt

    --
    Matthew Dharm                              Home: mdharm@one-eyed-alien.net
    Senior Engineer, QCP Inc.                            Work: mdharm@qcpi.com

    We can customize our colonels.
    					-- Tux
    User Friendly, 12/1/1998

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

- Next message: Jason: "PPro Bug Fix"
- Previous message: Luke Reeves: "Re: Linux 2.5 / 2.6 TODO (preliminary)"