[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <MWHPR0101MB29449166243291E394B17844C0F50@MWHPR0101MB2944.prod.exchangelabs.com>
Date: Tue, 23 Oct 2018 00:22:28 +0000
From: Ramon de C Valle <rcvalle@...e.com>
To: Andrew Sandoval <ASandoval@...root.com>, "oss-security@...ts.openwall.com"
<oss-security@...ts.openwall.com>
Subject: Re: GCC Compiler Induced Vulnerability - affects
programs compiled with GCC 7 and 8 containing nested functions
> This is already public because oss-security is a public mailing list.
>
> Most GNU/Linux distributions ensure that only very special binaries
> (such as some versions of the Ada compiler) enable executable stacks.
> In our experience, if the toolchain produces a binary that requests an
> executable stack, it is more likely due to manually written assembler
> files without the required stack executability markup section, and not
> due to nested C functions whose address escapes. Without scanning built
> binaries for these discrepancies, such cases could easily be missed.
>
> Please also note that an executable stack is not a vulnerability itself,
> and it is not directly exploitable. (The same applies to the lack of
> Intel CET support in binaries.)
While I agree with that I still think that this extension (or its name) is misleading, see https://lkml.org/lkml/2012/1/9/138. The PF_X flag set in the PT_GNU_STACK segment header or the absence of the PT_GNU_STACK segment header can result in an application unnoticeably having not only the stack, but also all readable virtual memory mappings also executable.
Ramon de C Valle
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
