[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20201203191644.GC534@brightrain.aerifal.cx>
Date: Thu, 3 Dec 2020 14:16:44 -0500
From: Rich Felker <dalias@...c.org>
To: Matthew Maurer <mmaurer@...gle.com>
Cc: musl@...ts.openwall.com
Subject: Re: [PATCH] harden against unauthorized writes to the atexit
function lists
On Thu, Dec 03, 2020 at 09:55:02AM -0800, Matthew Maurer wrote:
> While we are not a supported system, I would also note that I work on a
> project which *does* expect `atexit` to work properly, but does not have a
> working anonymous mmap system due to how resource management works for us.
>
> If ASLR is enabled, that should already mitigate the ability of an attacker
> to write to this location. While placing these in anonymous pages would be
> a further defense against cases where a pointer is leaked *and* an
> arbitrary overwrite is present, this would be an argument for a more
> complete form of randomization (see also pagerando,
> https://lists.llvm.org/pipermail/llvm-dev/2017-June/113794.html ) rather
> than trying to randomize the location of individual chunks of sensitive
> data.
Discussion on IRC and subsequently on Twitter seems to have
established that there are no direct paths for a reasonable program
following libc interface contracts to clobber libc .data/.bss memory
via attacker-controlled offset from a pointer valid for writing. So
(assuming dynamic linking; otherwise it may be possible via
offset from application .data/.bss) attacks on atexit array seem to
require already having achieved significant control over the victim
process.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
