Subject: Re: Code on stack (Re: exploit with memcpy())
To: Ignatios Souvatzis <ignatios@tarski.cs.uni-bonn.de>
From: Jason R Thorpe <thorpej@wasabisystems.com>
List: tech-userlevel
Date: 07/04/2002 09:31:50
On Thu, Jul 04, 2002 at 10:54:04AM +0200, Ignatios Souvatzis wrote:
> The procedure that seems appropriate is to have some flag in the executable
> that tells the exec() call to turn stack executability on. The toolchain would
> create it, if necessary. (If the sysadmin hasn't {switched of, compiled out of
> the kernel} support of this.).
You don't even need to do this.
The compiler emits code to sync the I-cache after the trampoline is spit
out onto the stack.
We could change the "sync the I-cache" code to also make a call to
mprotect(..., PROT_READ|PROT_WRITE|PROT_EXEC).
Then, when the pmap is invoked to make the protection change, it could
enable execution on the stack if the page being marked for execution is
a stack page.
--
-- Jason R. Thorpe <thorpej@wasabisystems.com>