1 Mar
2013
1 Mar
'13
6:35 p.m.
On Mar 1, 2013, at 8:15 PM, Alexander Schreiber wrote:
On Thu, Feb 28, 2013 at 07:25:22PM -0500, David Riley
wrote:
Sure. All I was saying was that there's nothing intrinsic in the
RPi that prevents buffer overflow exploits; "standard" buffer
overflow attacks will work, provided that their payload is
written for ARM Linux.
- Dave
On Feb 28, 2013, at 4:17 PM, Dave Wade wrote:
But running buffer overflow exploits with x86 specific machine code
payloads isn't going to get you anywhere on ARM. And there are software
based mitigation techniques that can seriously limit the impact of
buffer overflow exploits - the machine architecture based obscurity
defense won't protect you for long. I haven't heard of any. It's a modern
linux and most tasks run as non-root.
In addition on its a non-standard chip set so standard buffer over runs
don't work.
Er, what? Buffer overruns are the same regardless of what chipset
you run, at least as long as your stack grows downwards (most stacks,
including ARMs' stacks, do). Stack headspace randomization, which
is generally a software thing, can cause the code intended to be
executed by a buffer overrun fail (since there's no static offset to
branch to), but it's not a feature of the hardware on most machines.