What are Non-linear/backward overwrites?

Question

I read some slides from the Black Hat USA 2012 conference, and I stumbled across the term non-­linear/backward overwrite, mentioned on slide 5 of the Exploit Mitigation Improvements in Windows 8 by Ken Johnson and Matt Miller, Microsoft Security Engineering Center (MSEC) (PDF) presentation:

                         ^{Image attribution: Ken Johnson, Matt Miller, Microsoft Security Engineering Center (MSEC)}

According to this image, in Windows 7 there is no mitigation for this kind of overwrite, yet.

Has anyone a clue what this non-­linear/backward overwrite is, and can give me some additional information about this exploitation technique?

Answer 1

First of all, a "linear overwrite" is the most common type of buffer overflow. This is the example given in the slide. Where by starting at some base address you write in a linear fashion and eventually you overwrite the return address:

void function(LPCSTR input){
    char buffer[256];
    strcpy(buffer, input);
}

An example of a non-linear overwrite is this GroupWise ActiveX control exploit written by rGod. This ActiveX component has a method call where one of the parameters is a memory address, which allows an attacker to write to an arbitrary location in memory. If the return address was protected by a canary the attacker could just point directly to the return address and overwrite it without corrupting the canary. Dangling pointers can also produce a condition where by the attacker can control a specific address in which to read, write, or execute in a non-linear fashion.