ExecutableStacks
|
Size: 1803
Comment:
|
Size: 1991
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 3: | Line 3: |
| * check an ELF binary: "readelf -l $BIN | grep GNU_STACK" shows with "E" flag. | * check an ELF binary: "readelf -lW $BIN | grep GNU_STACK" shows with "E" flag. |
| Line 5: | Line 5: |
| * -Wl,-z,noexecstack will change the behavior of asm without stack markings. | |
| Line 6: | Line 7: |
| = Main/Restricted Packages = | |
| Line 8: | Line 10: |
| == Fixed == * zip * bogl |
|
| Line 9: | Line 15: |
| Uses [[http://grub.enbug.org/NestedFunctions|Nested Functions]] which compiler generates as trampolines on the stack. * bogl [[http://cvs.fedoraproject.org/viewvc//devel/bogl/bogl-0.1.18-noexecstack.patch?view=markup|patch]] | Uses [[http://grub.enbug.org/NestedFunctions|Nested Functions]] which compiler generates as trampolines on the stack. |
| Line 12: | Line 17: |
| * grub2 | * grub2 [[http://savannah.gnu.org/bugs/?25220|upstream bug]] == Stack Trampolines == * klibc (setjmp implementation) * kexec-tools (statically linked against klibc) == Shipped Precompiled Binary == * fglrx-installer * nvidia-graphics-drivers-173 * nvidia-graphics-drivers-180 * nvidia-graphics-drivers-71 * nvidia-graphics-drivers-96 |
| Line 15: | Line 31: |
| * fglrx-installer | |
| Line 22: | Line 37: |
| * nvidia-graphics-drivers-173 * nvidia-graphics-drivers-180 * nvidia-graphics-drivers-71 * nvidia-graphics-drivers-96 |
|
| Line 27: | Line 38: |
== Harmless == * kexec-tools * klibc |
There are still some programs that have executable stack regions.
- check an ELF binary: "readelf -lW $BIN | grep GNU_STACK" shows with "E" flag.
Gentoo write-up of what to do: http://www.gentoo.org/proj/en/hardened/gnu-stack.xml
- -Wl,-z,noexecstack will change the behavior of asm without stack markings.
Main/Restricted Packages
Originally generated from the ELF files with executable stacks in Karmic main.
Fixed
- zip
- bogl
Nested Functions
Uses Nested Functions which compiler generates as trampolines on the stack.
- grub
grub2 upstream bug
Stack Trampolines
- klibc (setjmp implementation)
- kexec-tools (statically linked against klibc)
Shipped Precompiled Binary
- fglrx-installer
- nvidia-graphics-drivers-173
- nvidia-graphics-drivers-180
- nvidia-graphics-drivers-71
- nvidia-graphics-drivers-96
Unclassified
- icon
- john
- link-grammar
- mbr
- memtest86+
- mono
- openjdk-6
Fedora Patches
http://cvs.fedoraproject.org/viewcvs/devel/gdk-pixbuf/gtk+-2.2.2-noexecstack.patch?view=markup
http://cvs.fedoraproject.org/viewcvs/devel/libdv/libdv-0.104-no-exec-stack.patch?view=markup
http://cvs.fedoraproject.org/viewcvs/devel/lightning/lightning-1.2-execstack.patch?view=markup
http://cvs.fedoraproject.org/viewcvs/devel/net-tools/net-tools-1.60-execshield.patch?view=markup
http://cvs.fedoraproject.org/viewcvs/devel/net-tools/netplug-1.2.9-execshield.patch?view=markup
http://cvs.fedoraproject.org/viewcvs/devel/mlton/mlton-20070826-no-execmem.patch?view=markup
SecurityTeam/Roadmap/ExecutableStacks (last edited 2017-08-22 14:25:31 by jdstrand)