Is the ARM processor used on the Raspberry Pi vulnerable to standard buffer overflows? That is, if a program that has a BO vulnerability is run on a Pi, will it be vulnerable to exploit?

How does the unique architecture of ARM and SoC affect the vulnerability, or the exploit?

Considering the lower footprint and smaller attack surface, what would be a likely vector of attack?

And most interestingly, does the Raspberry Pi support any builtin protections against overflows, such as ASLR, DEP / NX, canaries in general, etc?

  • All devices running OSX, most devices running Android and many phones and tablets running Windows have an ARM CPU with the same instruction set as the Pi. The ones running Android have the same kernel (possibly configured a bit differently). So most literature about Android exploitation at the native code level, and for that matter most literature about smartphone exploitation, applies to the Pi. – Gilles Dec 23 '13 at 1:00
  • @Gilles "All devices running OSX..." I might have missed something but... what? – Ayrx Dec 23 '13 at 4:54
  • @TerryChia Braino for iOS. – Gilles Dec 23 '13 at 13:22
  • is Django framwork vulerable to standard SQL injections ? – user45139 Dec 1 '14 at 12:06

The raspberry pi runs on the ARM1176JZF-S processor. ARM is used in more devices than just the Rpi. ARM exploitation is certainly possible. Have a look at the following papers:

Also have a look at this Defcon 18 presentation.

In regards to exploitation, Buffer overflows are definitely possible (refer to the papers for technical details). On many new platforms the stacks are non-executable, thus attempting to exploit them is more difficult than in the past. Techniques like ret2libc won't work because of the way ARM performs variable management. Variables are sometimes pushed across registers rather than being put on the stack, which makes it a lot more difficult to pop the right variables in order to jump to a piece of shellcode. Another type of attack can be used instead though as demonstrated in this paper which uses an adaption of the technique making use of Return Oriented Programming.

ASLR is primarily an Operating System responsibility. So it will largely depend on what OS you are running on your Rpi and if it was compiled with ASLR support. NX bits are implemented but can be circumvented using Return Oriented Programming.

Note that the ARM processor within the raspberry pi supports TrustZone which allows for two spaces:

  • Secure World
  • Normal World

ARM uses virtual cores to seperate these two worlds, which allow for different execution privileges (for instance on Android this is used to seperate your mobile payment module to execute in a completely different zone than your normal applications). So even when you might be able to exploit your device, there is still a possibility that you will not gain access to sensitive data.

In regards to plausible attack vectors, it would depend on what you use the Rpi for. For other devices implementing ARM, attacks have been used to for instance unlock boot loaders (the exploit actually was able to bypass secure to normal world protections).

  • The CPU in the Pi supports TrustZone, but does anybody use it for anything? – Gilles Dec 23 '13 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.