In -fstack-protector the compiler skip instrumenting certain functions which are not deemed to be unsafe (using heurisitics such as filtering out functions not allocating stack buffers etc). What would be the threat model in such a setup where not every return address is verified for non-taintedness?

If I understand it correctly the typical control flow integrity threat model is that the attacker can write to any writable memory word within two instructions.

As far I can think the threat model for -fstack-protector is bit relaxed where it is assumed no concurrent thread may not overwrite current threads return address in any meaningful way so as to cause an exploit.

If that's the case how effective is this relaxed threat model in presence of memory disclosure attacks? I feel exploitation would be hard even though this threat model is somewhat relaxed due to the fact that even if an attacker can guess the location of another concurrent thread it would be hard to cause an exploitable return due to

a) the difficulty in figuring out the return addresses within frames

b) the difficulty in correctly timing the write in order to overwrite a valid call stack frame

How effective are above assumptions about information hiding with respect to the state of the art in memory disclosure attacks?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.