Re: [Announcement] "Exec Shield", new Linux security feature

[H. Peter Anvin]

Chuck Ebbert wrote:
>>There is another issue: x86 uses relative jumps, so although "ASCII
>>armor" addresses aren't easily accessible using return address smashes
>>(although the \0 at the end thing is a real issue), you may be able to
>>get to them through a jump instruction.
> 
>  Does the instruction-pointer-relative data addressing mode added by
> AMD64 make these exploits easier?  Maybe someone should be working on a
> version of this patch for that platform...
> 

No, they don't, not if your mode of exploit is hacking return addresses 
on the stack.

AMD64 makes this pretty easy, *ALL* user-space addresses are in the 
"ASCII armour" area, and it supports exec-off.  Apparently this is 
currently off by default, but Andi Kleen says that they have identified 
the bug that caused it and they're making it available as a kernel option.

	-hpa