Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I read some slides from the Black Hat USA 2012 conference, and I stumbled across the term non-­linear/backward overwrite, mentioned on slide 5 of the Exploit Mitigation Improvements in Windows 8 by Ken Johnson and Matt Miller, Microsoft Security Engineering Center (MSEC) (PDF) presentation:

            History of exploit mitigations on Windows             Image attribution: Ken Johnson, Matt Miller, Microsoft Security Engineering Center (MSEC)

According to this image, in Windows 7 there is no mitigation for this kind of overwrite, yet.

Has anyone a clue what this non-­linear/backward overwrite is, and can give me some additional information about this exploitation technique?

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

First of all, a "linear overwrite" is the most common type of buffer overflow. This is the example given in the slide. Where by starting at some base address you write in a linear fashion and eventually you overwrite the return address:

void function(LPCSTR input){
    char buffer[256];
    strcpy(buffer, input);
}

An example of a non-linear overwrite is this GroupWise ActiveX control exploit written by rGod. This ActiveX component has a method call where one of the parameters is a memory address, which allows an attacker to write to an arbitrary location in memory. If the return address was protected by a canary the attacker could just point directly to the return address and overwrite it without corrupting the canary. Dangling pointers can also produce a condition where by the attacker can control a specific address in which to read, write, or execute in a non-linear fashion.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.