ExecutableStacks

Revision 33 as of 2009-08-19 22:28:50

Clear message

There are still some programs that have executable stack regions, which results in their being vulnerable to exploitation via stack memory. There are only a few very rare situations where executable stacks are actually desired, the rest are usually the result of lacking flags in assembly code or using nested functions (which are generally avoidable).

When the linker (ld) performs linking, it marks the stack as executable based on lowest common demoninator. For example, everything is marked non-executable except one .o file, so the entire library gets an executable stack. In the case of a shared library, this would pollute any program it was loaded into. (The assembler assumes that unmarked .S files need an executable stack, and marks it as such.)

If a user is running a PAE kernel or has other NX-memory protections, they lose the ability to protect that program's stack memory from execution, leaving it open to potential unknown future vulnerabilities that might try to execute shellcode from stack memory.

  • Detection:

    • found on the system, check an ELF binary: "readelf -lW $BIN | grep GNU_STACK" shows with "E" flag.
    • found in a build, check a .o file: "scanelf -e $BIN" shows an "X".

  • Information: Gentoo write-up about exec stack handling: http://www.gentoo.org/proj/en/hardened/gnu-stack.xml

  • Potential Solutions:

    • fix assembly source by adding flags to assembler: .section        .note.GNU-stack, "", @progbits

    • fix compiler's default when encountering unmarked assembly: -Wl,-z,noexecstack will change the behavior of compiler's asm-without-stack-markings defaults.

    • rework code to avoid using nested functions.
    • force markings into a safe state via "execstack -c $BINARY" during package build.

Main/Restricted Packages

Originally generated from the ELF files with executable stacks in Karmic main.

Fixed

  • zip (umarked asm)

  • bogl (nested function)

In Progress

Nested Functions

Uses Nested Functions which compiler generates as trampolines on the stack.

Trampolines

  • klibc (setjmp implementation)
  • kexec-tools (statically linked against klibc)

Actually using it???

  • mono (but only in the debugger, it seems)

Shipped Precompiled Binary

  • fglrx-installer

  • nvidia

    • nvidia-graphics-drivers-173
    • nvidia-graphics-drivers-180
    • nvidia-graphics-drivers-71
    • nvidia-graphics-drivers-96

Unmarked Assembler

  • john

No Stack Section

  • memtest86+ (is a boot-loaded ELF, not a big deal)

Fedora Patches for universe packages