A new exploitation method to bypass stack canaries
summary
Proposes master canary forging by forcing glibc to mmap a heap region adjacent to TLS then using a large malloc plus a heap overflow to overwrite the master canary so later stack overflows bypass canary checks. Demonstration uses Ubuntu 15.04, glibc malloc behaviour, GDB and a Python exploit; it succeeds in the demo but is fragile because it requires heap+stack bug and careful mmap placement. Recommends higher entropy or guard pages as mitigations.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:35Research motivation
- 2:39Stack canaries
- 4:24Existing bypass limits
- 7:20Leaking canary values
- 9:09New exploit concept
- 13:13Heap overflow technique
- 15:48Attack feasibility
- 16:57Attack evaluation
- 17:37Countermeasures
- 18:42Demo setup
- 20:18Exploit demo
- 24:35Q&A
related talks
22mDemostrating Binary Exploitation
37mHouse of Einherjar — Yet Another Heap Exploitation Technique on GLIBC
58mDemonstrating binary exploitation
01h 00mIntroduction to memory exploitation
51mThe Anatomy of an Exploit
01h 00mDemonstrating Binary Exploitation
48m"Attacking the TCache in GLibc 2.32"
18mExploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers