Re: [LIP] segment registers to handle stack over flow

On Wed, Jan 05, 2005 at 03:33:41PM +0530, suresh kumar wrote:
> Hi
> 
> you know about stack over flow exploit. generally the exploit code is
> written in data/heap portion of the code. and the address of that code
> is stored in the return address of the function to make the exploit. to
> load that address, segment register cs will be updated with the "ret"
> instruction. and while loading the segment selector in to the segment
> register, there are certain basic checks that will be done, to over
> come programatical errors. the checks include that a cs can be loaded
> with the selector of the executable segment.

The return is usually a near ret. In this case, cs remains unchanged.
Only during a far ret, both cs and ip will be loaded.

> Since data and heap come under data segments, why is that there is no
> exception as that malicious code is in data  portion of the code.
>
> Yeah I am talking specific to x86.

The real issue on old x86 processors is that the page tables don't have
enough bits to represent distinct 'R' and 'X' bits i.e. readable implies
executable.

But recent processors have the NX/ED bits (ED is Intel terminology)
by expanding the pte to 64 bits from 32 bits.

	-Arun


-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt