Kernel security: beyond bug fixing [LWN.net]

Kernel security: beyond bug fixing

Posted Oct 30, 2015 13:28 UTC (Fri) by mm7323 (subscriber, #87386)
In reply to: Kernel security: beyond bug fixing by dunlapg
Parent article: Kernel security: beyond bug fixing

You could change the ABIs to make the stack ascending, from low to high addresses. It's a lot of retooling, but there isn't any reason why it can't be done. ARM LDM and STM instructions have ascending modes, so the change wouldn't cost performance, though I have no idea about x86 and other architectures.

However, while such an ABI might make buffer overruns a little harder to exploit, because the overrun would generally be into the unused stack space, but I don't think it solves the problem; underuns or malicious code can still find return addresses in predictable read/write memory locations on the stack.

to post comments

Kernel security: beyond bug fixing

Posted Oct 30, 2015 13:54 UTC (Fri) by cladisch (✭ supporter ✭, #50193) [Link] (2 responses)

When an interrupt is raised, the CPU automatically pushes some registers (at least the program counter) onto the stack, so it is not possible to change the stack direction without hardware support, which most architectures do not have.

Kernel security: beyond bug fixing

Posted Oct 30, 2015 14:32 UTC (Fri) by mm7323 (subscriber, #87386) [Link] (1 responses)

> the CPU automatically pushes some registers

Is that an x86 thing?

On ARM, there are some shadow registers that backup the PC and the processor doesn't touch the stack itself - and rightly so! It's most efficient for the interrupt handler writer to decide what state needs to be saved and restored, particularly if the interrupt routine isn't going to do very much.

If a CPU did automatically push something on IRQ entry, you could still engineer an ABI that uses an 'empty ascending' stack where the stack pointer is maintained to point to the first unused word at the stack top.

I'm pretty sure you could run an ascending stack on ARM, probably other architectures too, but it would be for limited security benefits so moot.

Kernel security: beyond bug fixing

Posted Oct 30, 2015 15:28 UTC (Fri) by cladisch (✭ supporter ✭, #50193) [Link]

ARM is pretty much the only architecture where software can choose the stack direction.

There are many other architectures with optimized interrupt handling, but they do not have the same flexibility for normal function calls.