| Variables can be stored in the following areas of memory: Stack segment (local buffers with known sizes) Heap segment (dynamically allocated buffers with varying sizes) BSS and data segments (static buffers used for global variables)
If bounds checking of data that is copied and stored in memory isn't performed, logical program flow can be compromised. The following common threats are posed:
- Stack smash bugs
-
The saved instruction pointer for the stack frame is overwritten, which results in a compromise when the function epilogue occurs, and the instruction pointer is popped. This executes arbitrary code from a location of your choice.
- Stack off-by-one bugs
-
The least significant byte of the saved frame pointer for the stack frame is overwritten, which results in the parent stack frame existing at a slightly lower memory address than before (into memory that you control). You can overwrite the saved instruction pointer of the new stack frame and wait for the function to exit (requiring two returns in succession) or overwrite a function pointer or other variable found within the new stack frame. This attack is only effective against little endian processors, such as Intel x86 and DEC Alpha.
- Heap overflows
-
If you supply too much data to a buffer on the heap, you can overwrite both heap control structures for other memory chunks or overwrite function pointers or other data. Some heap implementations (such as BSD PHK, used by FreeBSD, NetBSD, and OpenBSD) don't mix heap data and control structures, so are only susceptible to function pointers and adjacent heap data being overwritten.
- Static overflows
-
Not discussed here, but static overflows are very similar to heap and off-by-one attacks. Logical program flow is usually compromised using a static overflow to overwrite a function pointer, generic pointer, or authentication flag. Static overflows are rare, due to the unusual global nature of the variable being overflowed.
- Integer overflows (delivery mechanism for stack, heap, and static overflows)
-
Calculation bugs result in large or negative numbers being processed by functions and routines that aren't expecting such values. Integer overflows are technically a delivery mechanism for a stack, heap, or static overflow, usually resulting in sensitive values being overwritten (saved instruction and frame pointers, heap control structures, function pointers, etc.).
- Format string bugs
-
Various functions (including printf( ) and syslog( )) provide direct memory access via format strings. If an attacker can provide a series of format strings, he can often read data directly from memory or write data to arbitrary locations. The functionality within printf( ) is simply being abused by forcing processing of crafted format strings; no overflow occurs.
|
