Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1649529

Re: stackprotector: ascii armor the stack canary

Show all headers | View raw

On Fri, May 19, 2017 at 11:32 PM, Kees Cook <keescook@chromium.org> wrote:
> On Fri, May 19, 2017 at 2:26 PM,  <riel@redhat.com> wrote:
>> Zero out the first byte of the stack canary value on 64 bit systems,
>> in order to prevent unterminated C string overflows from being able
>> to successfully overwrite the canary, even if an attacker somehow
>> guessed or obtained the canary value.
>
> This also stops string functions from being able to read the canary.
>
> It might also be worth mentioning that the reduction in entropy for
> 64-bit to gain this corner-case protection is worth it, but on 32-bit,
> it is not. (Which is especially true given that the 64-bit canary was
> only 32-bits in some cases until recently.)

+1

It took me a while to deduce that myself, when I started wondering why
this was not done for 32-bit.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: stackprotector: ascii armor the stack canary Kees Cook <keescook@chromium.org> - 2017-05-19 23:40 +0200
  Re: stackprotector: ascii armor the stack canary Geert Uytterhoeven <geert@linux-m68k.org> - 2017-05-24 14:00 +0200

csiph-web