Skip to main content
Share Your Experience: Take the 2024 Developer Survey
29 votes
Accepted

Why are AMD processors not/less vulnerable to Meltdown and Spectre?

Only Meltdown is specifically an Intel vulnerability / design flaw. update: it seems AMD is mostly resilient to Spectre. It's not clear why that would be the case. But according to AMD: (from early ...
Peter Cordes's user avatar
21 votes

Why does my x86 shellcode test program segfault?

I see multiple problems with your shellcode. First of all let's debug your code. I compiled the C code containing your shellcode, run it with gdb and step until the first system call (int 0x80) [-----...
Mr. E's user avatar
  • 1,964
15 votes

Do high level languages allow for buffer / heap overflow?

"level" of a programming languages is not a particularly well-defined concept. C++ for example would generally be regarded as a higher-level language then C but it still leaves the user open ...
Peter Green's user avatar
  • 5,300
8 votes

Program exiting after executing int 0x80 instruction when running shellcode

If you are running this from the command line, and you are using the < to feed the shellcode from a file, the shell will immediately terminate when it reaches the end of input. If you want it to ...
lintile's user avatar
  • 81
7 votes

What is known about the capabilities of AMD's Secure Processor?

I was interested in the same issue and did some preliminary research. I'll try to answer some of the questions, though as a non-AMD engineer I cannot be certain. Does it have software-updatable ...
laanwj's user avatar
  • 171
6 votes

What is known about the capabilities of AMD's Secure Processor?

So what I would say is anything that provides direct memory access and essentially does processing on behalf of the processor is a whole other set of threat surfaces you are introducing to the ...
Ori's user avatar
  • 2,777
6 votes
Accepted

How to exploit variable's value

You are right that the buffer cannot overflow the flag because of the bounds check. Fgets also includes the null character in its bound check. http://www.cplusplus.com/reference/cstdio/fgets/ However,...
Daniel Grover's user avatar
5 votes
Accepted

If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries?

First, this is not an OS question but more of a compiler one. OS can only execute binary programs that contain machine instructions and that can (if they were instructed to) test the overflow flag. ...
Serge Ballesta's user avatar
4 votes
Accepted

Linux Kernel ROP - Returning to userland from kernel context?

I ended up writing my shellcode in a different way. As I could not figure out how to return, I let the kernel do the heavy lifting for me, in returning to userland. The idea was to execute my ...
Mukesh Sai Kumar's user avatar
4 votes

If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries?

why aren't operating systems using this overflow flag to stop integer overflows? The operating system can't just forbid integer overflows, because sometimes it's not a bug but a feature. There is ...
Philipp's user avatar
  • 49.4k
4 votes

Buffer Overflow doesn't have enough space for exploit after being crashed

Assuming that you're talking about a vanilla EIP overwrite and not something like SEH, you have two options available to you. Neither of these are what I would consider to be "beginner" techniques as ...
DKNUCKLES's user avatar
  • 9,217
4 votes
Accepted

What lies behind this complicated shellcode on linux?

If you have tried shellcode before which relies on absolute addresses, then that could explain the crashes. This shellcode survives because it uses call to obtain the absolute stack pointer address ...
Lekensteyn's user avatar
  • 6,078
3 votes

Exploit a buffer overflow without SIGSEGV

Returning to normal execution from shellcode is hard. You're exactly right. Your function likely doesn't have a valid return address. I'm not entirely sure this is your problem, but your attempt ...
RoraΖ's user avatar
  • 12.5k
2 votes

Are memcpy() based race conditions exploitable for causing remote code execution?

Based on what I see here, you can modify *src after ValidateOpcodesOrCrash finished checking that part of the memory but before SafeMemcpy starts. I don't know how ValidateOpcodesOrCrash is ...
Lie Ryan's user avatar
  • 31.4k
2 votes

How to exploit variable's value

flag is not local to any function and global in scope. Therefore, it is not located on the runtime stack. Either patch the binary or take advantage of the fact that input to buf is not sanitized and ...
julian's user avatar
  • 1,299
2 votes

Do high level languages allow for buffer / heap overflow?

The property you are looking for is called "memory safety", meaning that all memory access is well-typed and within bounds. Most high-level programming languages are specified to provide ...
meriton's user avatar
  • 1,488
2 votes

Do high level languages allow for buffer / heap overflow?

tl;dr: (most) high-level languages specifically protect you from that, but a very rare bug could make those protections fail. Long version: High-level languages are (generally) designed as not to ...
GuilleOjeda's user avatar
2 votes
Accepted

Android x86 vs Android on Qemu ARM

Answer: Low-level vulnerabilities, such as buffer overflows in the stagefright binary or underlying Linux kernel, will behave differently on every system that you run them on (ie: x86 Android, QEMU ...
disinformat's user avatar
1 vote

Can a meltdown attack also violate data integrity of other processes or is it just violating data secrecy?

Meltdown does not directly impact integrity, but it totally violates confidentiality. Whether or not the violation of confidentiality is sufficient to also violate integrity (e.g. read root password, ...
forest's user avatar
  • 66.8k
1 vote

In Return-Oriented Programming how can the machine execute unaligned instructions?

x86 is not RISC. The instructions are variable length. From 1 to 15 bytes. They are of course not aligned. Few things on x86 are aligned (atomics, some vector instructions, cache lines of course, etc.)...
Z.T.'s user avatar
  • 8,514
1 vote

If x86 architecture has overflow flag in the CPU, then why can't we use it to detect integer overflows in C binaries?

OS can't really check what the program is doing at the single add instruction level. This requires compiler to generate the conditional jump after every integer operation. That's a lot of additional ...
Andrew Morozko's user avatar
1 vote

What lies behind this complicated shellcode on linux?

The Assembly that you've posted is not the shellcode, as you mentioned but rather the unpacking and execution of the shell script. The shellcode being executed is \xeb\x1f\x5b\x31\xc0\x88\x43\x0b\x88\...
DKNUCKLES's user avatar
  • 9,217
1 vote
Accepted

Buffer Overflow doesn't have enough space for exploit after being crashed

There are various ways to do this. Are you able to get a fixed point in the code to set your EIP to? You are not telling us whether you have any ASLR restrictions, but if you do, are you then able to ...
RLFP's user avatar
  • 617
1 vote
Accepted

C library functions in statically linked ELF32 binary no longer use int 0x80

int $0x80 is indeed executed by some of the C library functions in the statically linked binary, but not by nearly as many library functions as one would expect given how many library functions are ...
julian's user avatar
  • 1,299
1 vote
Accepted

ROP payload layout confusion

There's no need to perform any push operations since you control the stack already. You can have the data you wish to store within your registers already placed where you can conveniently perform ...
dreamist's user avatar
1 vote

Program exiting after executing int 0x80 instruction when running shellcode

Use shellcode which reopens the inputs. For example, this 58-byte modified version of Marco Ivaldi's code does this trick: "\x83\xc4\x10\x31\xc0\x31\xdb\xb0\x06\xcd\x80\x53\x68/tty\x68/dev\x89\xe3\...
Aralox's user avatar
  • 111
1 vote

Is dereferencing a null pointer in C a security risk if the program isn’t a daemon, but a small script lauched as a separate process for each request?

Not doing any checks whether a given pointer is NULL might not be exploitable at all, but I don't think in your case it matters if the program runs as daemon or not. The crucial question here is more ...
kaidentity's user avatar
  • 2,654
1 vote
Accepted

Is dereferencing a null pointer in C a security risk if the program isn’t a daemon, but a small script lauched as a separate process for each request?

Dereferncing a null pointer can be a security risk on some architectures and operating systems, and whether it is a daemon or a handler or whether the function or method itself accesses the file ...
Douglas Daseeco's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible