Farm Fresh! From Your Yard to Your Table.......: Linux Stack Protection By Default

Modern gcc compiler (v9.2.0) protects the stack by default and you will notice it because instead of SIGSEGV on stack overflow you will get a SIGABRT, but it also generates coredumps.

In this case the compiler adds the variable local_10. This variable helds a canary value that is checked at the end of the function.
The memset overflows the four bytes stack variable and modifies the canary value.

The 64bits canary 0x5429851ebaf95800 can't be predicted, but in specific situations is not re-generated and can be bruteforced or in other situations can be leaked from memory for example using a format string vulnerability or an arbitrary read wihout overflowing the stack.

If the canary doesn't match, the libc function __stack_chck_fail is called and terminates the prorgam with a SIGABORT which generates a coredump, in the case of archlinux managed by systemd and are stored on "/var/lib/systemd/coredump/"

❯❯❯ ./test
*** stack smashing detected ***: terminated
fish: './test' terminated by signal SIGABRT (Abort)

❯❯❯ sudo lz4 -d core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000.lz4
[sudo] password for xxxx:
Decoding file core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000
core.test.1000.c611b : decoded 249856 bytes

❯❯❯ sudo gdb /home/xxxx/test core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 -q

We specify the binary and the core file as a gdb parameters. We can see only one LWP (light weight process) or linux thread, so in this case is quicker to check. First of all lets see the back trace, because in this case the execution don't terminate in the segfaulted return.

We can see on frame 5 the address were it would had returned to main if it wouldn't aborted.

Happy Idea: we can use this stack canary aborts to detect stack overflows. In Debian with prevous versions it will be exploitable depending on the compilation flags used.
And note that the canary is located as the last variable in the stack so the previous variables can be overwritten without problems.

More information

The Butcher, The Baker, The Candlestick Maker (and The Vegetable Maker)

Before the days of interstate highways and super mega magnum marts any town with more than one stop sign was almost self sufficient. The space between towns and villages were filled with farms that dotted the landscape. The farmers were smart in that they located towns to supply the communities that surrounded them. Today we think Wal-Mart is ingenious for doing the same thing!

Homes all had gardens that were sized according to how large the family was. That time for for gardens at every home is here again. Fresh wholesome food delivered from your back yard to your table.

The reasons do not matter. You may be a weekender in a small town who wants fresh herbs or produce from the back yard of your weekend home. Or you may be struggling to pay high energy prices and looking for a way to save a little green by growing something green.

That's where "Your Back Yard Harvest" comes in. I will work with you to design, build and even go so far as to provide regular harvesting services so your produce is washed and waiting at your door step when you arrive. Or if you just want a little advice along the way let me be your green thumb consultant.

Farm Fresh! From Your Yard to Your Table.......

26 January, 2024

Linux Stack Protection By Default

No comments:

To Schedule an Appointment or for More Information E-mail Me Today

The Butcher, The Baker, The Candlestick Maker (and The Vegetable Maker)

Blog Archive

About Me

Farm Fresh! From Your Yard to Your Table.......

26 January, 2024

Linux Stack Protection By Default

No comments:

To Schedule an Appointment or for More Information E-mail Me Today

The Butcher, The Baker, The Candlestick Maker (and The Vegetable Maker)

Blog Archive

About Me

Get Growing