Academia.eduAcademia.edu

Figure from:Protecting Systems from Stack Smashing Attacks with StackGuard

See full PDFdownloadDownload figure
TUNnCTLON Provcogue alla function_epilogue functions have been altered to emit code to place and check canary words. The changes are architecture-specific (in our case, 1386), but since the total changes to the gcc code generator are under 100 lines, portability is not a major concern. All the changes in the gcc calling conventions are undertaken by the callee, so code compiled with the StackGuard-enhanced gcc is completely inter-opera- ble with generic gcc .o files and libraries. The addi- tional instructions added to the function prologue are shown in pseudo-assembly form in Figure 3, and the additional instructions added to the instruction epi- logue are shown in Figure 3.

Figure 3 TUNnCTLON Provcogue alla function_epilogue functions have been altered to emit code to place and check canary words. The changes are architecture-specific (in our case, 1386), but since the total changes to the gcc code generator are under 100 lines, portability is not a major concern. All the changes in the gcc calling conventions are undertaken by the callee, so code compiled with the StackGuard-enhanced gcc is completely inter-opera- ble with generic gcc .o files and libraries. The addi- tional instructions added to the function prologue are shown in pseudo-assembly form in Figure 3, and the additional instructions added to the instruction epi- logue are shown in Figure 3.

Related Figures (3)

smashing attacks. Section 4 presents the procedure for re-building the large set of packages in a Linux distri- bution. Section 5 describes the impact of StackGuard protection on the system’s operation. Section 6 dis- cusses the effective protection provided by these efforts. Section 7 covers related work. Section 8 dis- cusses the availability of a StackGuard-protected Linux distribution. Finally, Section 9 presents our conclusions.
smashing attacks. Section 4 presents the procedure for re-building the large set of packages in a Linux distri- bution. Section 5 describes the impact of StackGuard protection on the system’s operation. Section 6 dis- cusses the effective protection provided by these efforts. Section 7 covers related work. Section 8 dis- cusses the availability of a StackGuard-protected Linux distribution. Finally, Section 9 presents our conclusions.
beyond the scope of this paper. Such a demonstration requires us to show that all possible entries are pro- tected, while the attacker need only find one unpro- tected program. Rather, we will show the degree of protection offered by StackGuard by examining the behavior of programs known to be vulnerable to stack smashing attacks. large number of clients. In the worst case, the unpro- tected Apache has a 8% advantage in connections per second, even though the protected web server has a slight advantage in average latency on the same test. As before, we attribute these variances to noise, and conclude that StackGuard protection has no signifi- cant impact on web server performance.
beyond the scope of this paper. Such a demonstration requires us to show that all possible entries are pro- tected, while the attacker need only find one unpro- tected program. Rather, we will show the degree of protection offered by StackGuard by examining the behavior of programs known to be vulnerable to stack smashing attacks. large number of clients. In the worst case, the unpro- tected Apache has a 8% advantage in connections per second, even though the protected web server has a slight advantage in average latency on the same test. As before, we attribute these variances to noise, and conclude that StackGuard protection has no signifi- cant impact on web server performance.
onto the stack cannot be executed. They offer the advantages of zero performance penalty, and that pro- grams work and are protected without re-compilation. However, they do necessitate running a specially- patched kernel, unless this approach is adopted as a standard; Solaris 2.6 incorporates a non-executable stack as a configuration option in /etc/system. return address to the attack code on the heap. Stack- Guard would stop this form of attack.
onto the stack cannot be executed. They offer the advantages of zero performance penalty, and that pro- grams work and are protected without re-compilation. However, they do necessitate running a specially- patched kernel, unless this approach is adopted as a standard; Solaris 2.6 incorporates a non-executable stack as a configuration option in /etc/system. return address to the attack code on the heap. Stack- Guard would stop this form of attack.