Re: [kernel-hardening] [PATCH v2 0/5] stackprotector: ascii armor the stack canary

2017-09-20 Thread Solar Designer
On Wed, Sep 20, 2017 at 01:18:04PM +0200, Yann Droneaud wrote: > Le mardi 19 septembre 2017 ?? 19:16 +0200, Solar Designer a ??crit : > > > > We could put/require a NUL in the middle of the canary, > > but with the full canary being only 64-bit at most that would also > > make some attacks easier.

Re: [kernel-hardening] [PATCH v2 0/5] stackprotector: ascii armor the stack canary

2017-09-20 Thread Yann Droneaud
Hi, Le mardi 19 septembre 2017 à 19:16 +0200, Solar Designer a écrit : > > We could put/require a NUL in the middle of the canary, > but with the full canary being only 64-bit at most that would also > make some attacks easier. > Are you suggesting to randomly select which byte to set to 0 in ea

Re: [kernel-hardening] [PATCH v2 0/5] stackprotector: ascii armor the stack canary

2017-09-19 Thread Daniel Micay
> Brad trolls us all lightly with this trivia question: > > https://twitter.com/grsecurity/status/905246423591084033 I'll respond to your proposed scenario rather than guessing at what is being suggested there and if it's actually the same thing as what you've brought up. They've stated many tim

Re: [kernel-hardening] [PATCH v2 0/5] stackprotector: ascii armor the stack canary

2017-09-19 Thread Kees Cook
On Tue, Sep 19, 2017 at 10:16 AM, Solar Designer wrote: > On Wed, May 24, 2017 at 11:57:46AM -0400, r...@redhat.com wrote: >> Zero out the first byte of the stack canary value on 64 bit systems, >> in order to mitigate unterminated C string overflows. >> >> The null byte both prevents C string fun

Re: [kernel-hardening] [PATCH v2 0/5] stackprotector: ascii armor the stack canary

2017-09-19 Thread Solar Designer
On Wed, May 24, 2017 at 11:57:46AM -0400, r...@redhat.com wrote: > Zero out the first byte of the stack canary value on 64 bit systems, > in order to mitigate unterminated C string overflows. > > The null byte both prevents C string functions from reading the > canary, and from writing it if the c

[PATCH v2 0/5] stackprotector: ascii armor the stack canary

2017-05-24 Thread riel
Zero out the first byte of the stack canary value on 64 bit systems, in order to mitigate unterminated C string overflows. The null byte both prevents C string functions from reading the canary, and from writing it if the canary value were guessed or obtained through some other means. Reducin

Re: stackprotector: ascii armor the stack canary

2017-05-24 Thread Geert Uytterhoeven
On Fri, May 19, 2017 at 11:32 PM, Kees Cook wrote: > On Fri, May 19, 2017 at 2:26 PM, wrote: >> Zero out the first byte of the stack canary value on 64 bit systems, >> in order to prevent unterminated C string overflows from being able >> to successfully overwrite the canary, even if an attacker

Re: stackprotector: ascii armor the stack canary

2017-05-19 Thread Daniel Micay
On Fri, 2017-05-19 at 17:26 -0400, r...@redhat.com wrote: > Zero out the first byte of the stack canary value on 64 bit systems, > in order to prevent unterminated C string overflows from being able > to successfully overwrite the canary, even if an attacker somehow > guessed or obtained the canary

stackprotector: ascii armor the stack canary

2017-05-19 Thread riel
Zero out the first byte of the stack canary value on 64 bit systems, in order to prevent unterminated C string overflows from being able to successfully overwrite the canary, even if an attacker somehow guessed or obtained the canary value. Inspired by execshield ascii-armor and PaX/grsecurity. T

Re: stackprotector: ascii armor the stack canary

2017-05-19 Thread Kees Cook
On Fri, May 19, 2017 at 2:26 PM, wrote: > Zero out the first byte of the stack canary value on 64 bit systems, > in order to prevent unterminated C string overflows from being able > to successfully overwrite the canary, even if an attacker somehow > guessed or obtained the canary value. This al