Re: [LIP] segment registers to handle stack over flow

On Wed, January 5, 2005 3:33 pm, suresh kumar said:
> Hi
>
> you know about stack over flow exploit. generally the exploit code is
> written in data/heap portion of the code. and the address of that code is
> stored in the return address of the function to make the exploit. to load
> that address, segment register cs will be updated with the "ret"
> instruction. and while loading the segment selector in to the segment
> register, there are certain basic checks that will be done, to over come
> programatical errors. the checks include that a cs can be loaded with the
> selector of the executable segment.


i think there is a basic mistake in understanding stack overflows with
respect to intel x86 atleast (dont know about other systems). In newer
32-bit systems segmentation is just a myth since all modern OS's use
Flat-Memory Model where every segment spans the complete 4GB address
space.

so there is nothing like a FAR CALL(where CS and IP both changed) and a
NEAR CALL(where only IP changes). Segment registers CS & DS change only
when there is a transition from KERNEL MODE TO USER MODE or vice versa
i.e. during "int 0x80".

Although the kernel code segment __KERNEL_CS,  user code segment __USER_CS
, kernel data segment __KERNEL_DS and user data segment __USER_DS overlap
each other, still they differ in the access rights like CPU privilege
Level(kernel=ring0 and user=ring3, refer GDT and LDT) and execute
permission(Data segments are non-executable).

so coming back to the assembly instruction "ret", only the IP register
would change. hence the CPU has no way to check the legitimacy of the
address.

To solve the buffer overflow, some modern architectures make the stack
non-executable( i think amd64 does so). but for Intel x86 it is executable
and hence the buffer overflow attacks.

i hope i am not wrong. if i am please correct me.


>
> Since data and heap come under data segments, why is that there is no
> exception as that malicious code is in data  portion of the code.
>
> Yeah I am talking specific to x86.
>
> Is there any thing wrong in my understanding?
> Is my question correct?
>
> regards
> Suresh
> V.V Suresh Kumar


-- 
Trideepraj Roychoudhury
FSA Labs ( http://www.fsalabs.com )




-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt