Current reading: Linux 2.6.x vsyscalls may be used as powerful attack vectors. The basic premise of this paper is that since each process has the vsyscall code mapped into its address space, and the vsyscall code is almost never changed, if you can figure a way to jmp to it from your shell code you can use various instructions there (or data bytes masquerading as instructions) to aid your shell code. Makes sense, and the usual solutions apply – for example, randomization of the vsyscall page.
April 26, 2005
3 Comments »
RSS feed for comments on this post. TrackBack URI
Muli Ben-Yehuda's journal 
I think that gives me something to do on my next train ride.
Comment by the_p0pe — April 26, 2005 @ 2:55 PM |
Plenty more where that came from[1]; I’ll be posting them as I get to them.
[1] that would be my “stuff to read” pile, of course.
Comment by mulix — April 26, 2005 @ 3:11 PM |
PaX/GrSecurity
That’s the reason PaX/GrSecurity disable vsyscalls.
Comment by Anonymous — April 30, 2005 @ 12:49 AM |