28
votes
Accepted
Why are AMD processors not/less vulnerable to Meltdown and Spectre?
Only Meltdown is specifically an Intel vulnerability / design flaw.
update: it seems AMD is mostly resilient to Spectre. It's not clear why that would be the case. But according to AMD:
(from early ...
- 888
21
votes
Why does my x86 shellcode test program segfault?
I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80)
[-----...
- 1,954
15
votes
Do high level languages allow for buffer / heap overflow?
"level" of a programming languages is not a particularly well-defined concept.
C++ for example would generally be regarded as a higher-level language then C but it still leaves the user open ...
- 5,190
8
votes
Program exiting after executing int 0x80 instruction when running shellcode
If you are running this from the command line, and you are using the < to feed the shellcode from a file, the shell will immediately terminate when it reaches the end of input. If you want it to ...
- 81
8
votes
Accepted
Defeating ROP attacks in x86
No. Actually, most RoP attacks make use of existing codes (former return-into-libc-attacks). So, the RoP gadgets are snippets of existing code and have to be executable.
- 96
6
votes
Accepted
How to exploit variable's value
You are right that the buffer cannot overflow the flag because of the bounds check. Fgets also includes the null character in its bound check.
http://www.cplusplus.com/reference/cstdio/fgets/
However,...
- 872
6
votes
What is known about the capabilities of AMD's Secure Processor?
I was interested in the same issue and did some preliminary research. I'll try to answer some of the questions, though as a non-AMD engineer I cannot be certain.
Does it have software-updatable ...
- 161
5
votes
What is known about the capabilities of AMD's Secure Processor?
So what I would say is anything that provides direct memory access and essentially does processing on behalf of the processor is a whole other set of threat surfaces you are introducing to the ...
- 2,757
5
votes
Accepted
If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries?
First, this is not an OS question but more of a compiler one. OS can only execute binary programs that contain machine instructions and that can (if they were instructed to) test the overflow flag.
...
- 26.5k
4
votes
If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries?
why aren't operating systems using this overflow flag to stop integer overflows?
The operating system can't just forbid integer overflows, because sometimes it's not a bug but a feature. There is ...
- 49.3k
4
votes
Accepted
Linux Kernel ROP - Returning to userland from kernel context?
I ended up writing my shellcode in a different way. As I could not figure out how to return, I let the kernel do the heavy lifting for me, in returning to userland. The idea was to execute my ...
- 220
4
votes
Buffer Overflow doesn't have enough space for exploit after being crashed
Assuming that you're talking about a vanilla EIP overwrite and not something like SEH, you have two options available to you. Neither of these are what I would consider to be "beginner" techniques as ...
- 9,227
4
votes
Accepted
What lies behind this complicated shellcode on linux?
If you have tried shellcode before which relies on absolute addresses, then that
could explain the crashes. This shellcode survives because it uses call to
obtain the absolute stack pointer address ...
- 6,078
4
votes
Accepted
Defeating code injection attacks in x86
Making the injected payload "not executable" is what Data Execution Prevention is about. There are various techniques to achieve that, depending on what the underlying hardware can do. On most ...
- 172k
3
votes
Exploit a buffer overflow without SIGSEGV
Returning to normal execution from shellcode is hard.
You're exactly right. Your function likely doesn't have a valid return address. I'm not entirely sure this is your problem, but your attempt ...
- 12.4k
2
votes
Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?
TL;DR
The reason why they're bad is listed in the links you've provided. Due to how the Windows OS is designed, the way the functions were coded, and the fact that determining if memory is valid is ...
- 12.4k
2
votes
Are memcpy() based race conditions exploitable for causing remote code execution?
Based on what I see here, you can modify *src after ValidateOpcodesOrCrash finished checking that part of the memory but before SafeMemcpy starts.
I don't know how ValidateOpcodesOrCrash is ...
- 31.4k
2
votes
How to exploit variable's value
flag is not local to any function and global in scope. Therefore, it is not located on the runtime stack. Either patch the binary or take advantage of the fact that input to buf is not sanitized and ...
- 1,289
2
votes
Accepted
Android x86 vs Android on Qemu ARM
Answer: Low-level vulnerabilities, such as buffer overflows in the stagefright binary or underlying Linux kernel, will behave differently on every system that you run them on (ie: x86 Android, QEMU ...
- 71
2
votes
Do high level languages allow for buffer / heap overflow?
tl;dr: (most) high-level languages specifically protect you from that, but a very rare bug could make those protections fail.
Long version:
High-level languages are (generally) designed as not to ...
- 121
2
votes
Do high level languages allow for buffer / heap overflow?
The property you are looking for is called "memory safety", meaning that all memory access is well-typed and within bounds.
Most high-level programming languages are specified to provide ...
- 1,478
1
vote
Can a meltdown attack also violate data integrity of other processes or is it just violating data secrecy?
Meltdown does not directly impact integrity, but it totally violates confidentiality. Whether or not the violation of confidentiality is sufficient to also violate integrity (e.g. read root password, ...
- 66.5k
1
vote
In Return-Oriented Programming how can the machine execute unaligned instructions?
x86 is not RISC. The instructions are variable length. From 1 to 15 bytes. They are of course not aligned. Few things on x86 are aligned (atomics, some vector instructions, cache lines of course, etc.)...
- 8,434
1
vote
If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries?
OS can't really check what the program is doing at the single add instruction level. This requires compiler to generate the conditional jump after every integer operation. That's a lot of additional ...
- 1,759
1
vote
Accepted
Buffer Overflow doesn't have enough space for exploit after being crashed
There are various ways to do this. Are you able to get a fixed point in the code to set your EIP to? You are not telling us whether you have any ASLR restrictions, but if you do, are you then able to ...
- 617
1
vote
Accepted
C library functions in statically linked ELF32 binary no longer use int 0x80
int $0x80 is indeed executed by some of the C library functions in the statically linked binary, but not by nearly as many library functions as one would expect given how many library functions are ...
- 1,289
1
vote
Accepted
ROP payload layout confusion
There's no need to perform any push operations since you control the stack already. You can have the data you wish to store within your registers already placed where you can conveniently perform ...
- 94
1
vote
What lies behind this complicated shellcode on linux?
The Assembly that you've posted is not the shellcode, as you mentioned but rather the unpacking and execution of the shell script.
The shellcode being executed is \xeb\x1f\x5b\x31\xc0\x88\x43\x0b\x88\...
- 9,227
1
vote
Is dereferencing a null pointer in C a security risk if the program isn’t a daemon, but a small script lauched as a separate process for each request?
Not doing any checks whether a given pointer is NULL might not be exploitable at all, but I don't think in your case it matters if the program runs as daemon or not. The crucial question here is more ...
- 2,634
Only top scored, non community-wiki answers of a minimum length are eligible