Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1645967 > unrolled thread

Re: stackprotector: ascii armor the stack canary

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: stackprotector: ascii armor the stack canary Kees Cook <keescook@chromium.org> - 2017-05-19 23:40 +0200
    Re: stackprotector: ascii armor the stack canary Geert Uytterhoeven <geert@linux-m68k.org> - 2017-05-24 14:00 +0200

#1645967 — Re: stackprotector: ascii armor the stack canary

On Fri, May 19, 2017 at 2:26 PM,  <riel@redhat.com> wrote:
> Zero out the first byte of the stack canary value on 64 bit systems,
> in order to prevent unterminated C string overflows from being able
> to successfully overwrite the canary, even if an attacker somehow
> guessed or obtained the canary value.

This also stops string functions from being able to read the canary.

It might also be worth mentioning that the reduction in entropy for
64-bit to gain this corner-case protection is worth it, but on 32-bit,
it is not. (Which is especially true given that the 64-bit canary was
only 32-bits in some cases until recently.)

> Inspired by execshield ascii-armor and PaX/grsecurity.
>
> Thanks to Daniel Micay for extracting code of similar functionality
> from PaX/grsecurity and making it easy to find in his linux-hardened
> git tree on https://github.com/thestinger/linux-hardened/

Thanks!

Acked-by: Kees Cook <keescook@chromium.org>

-Kees

-- 
Kees Cook
Pixel Security

[toc] | [next] | [standalone]

#1649529

On Fri, May 19, 2017 at 11:32 PM, Kees Cook <keescook@chromium.org> wrote:
> On Fri, May 19, 2017 at 2:26 PM,  <riel@redhat.com> wrote:
>> Zero out the first byte of the stack canary value on 64 bit systems,
>> in order to prevent unterminated C string overflows from being able
>> to successfully overwrite the canary, even if an attacker somehow
>> guessed or obtained the canary value.
>
> This also stops string functions from being able to read the canary.
>
> It might also be worth mentioning that the reduction in entropy for
> 64-bit to gain this corner-case protection is worth it, but on 32-bit,
> it is not. (Which is especially true given that the 64-bit canary was
> only 32-bits in some cases until recently.)

+1

It took me a while to deduce that myself, when I started wondering why
this was not done for 32-bit.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web