Re: [RFC] prevention of syscalls from writable segments, breaking bugexploits

2001-01-03 Thread Mark Zealey
On Wed, 3 Jan 2001, Brian Gerst wrote: > Dan Aloni wrote: > > > > It is known that most remote exploits use the fact that stacks are > > executable (in i386, at least). > > > > On Linux, they use INT 80 system calls to execute functions in the kernel > > as root, when the stack is smashed as a

Re: [RFC] prevention of syscalls from writable segments, breaking bugexploits

2001-01-03 Thread Brian Gerst
Dan Aloni wrote: > > It is known that most remote exploits use the fact that stacks are > executable (in i386, at least). > > On Linux, they use INT 80 system calls to execute functions in the kernel > as root, when the stack is smashed as a result of a buffer overflow bug in > various server

[RFC] prevention of syscalls from writable segments, breaking bugexploits

2001-01-03 Thread Dan Aloni
It is known that most remote exploits use the fact that stacks are executable (in i386, at least). On Linux, they use INT 80 system calls to execute functions in the kernel as root, when the stack is smashed as a result of a buffer overflow bug in various server software. This preliminary,

[RFC] prevention of syscalls from writable segments, breaking bugexploits

2001-01-03 Thread Dan Aloni
It is known that most remote exploits use the fact that stacks are executable (in i386, at least). On Linux, they use INT 80 system calls to execute functions in the kernel as root, when the stack is smashed as a result of a buffer overflow bug in various server software. This preliminary,

Re: [RFC] prevention of syscalls from writable segments, breaking bugexploits

2001-01-03 Thread Brian Gerst
Dan Aloni wrote: It is known that most remote exploits use the fact that stacks are executable (in i386, at least). On Linux, they use INT 80 system calls to execute functions in the kernel as root, when the stack is smashed as a result of a buffer overflow bug in various server

Re: [RFC] prevention of syscalls from writable segments, breaking bugexploits

2001-01-03 Thread Mark Zealey
On Wed, 3 Jan 2001, Brian Gerst wrote: Dan Aloni wrote: It is known that most remote exploits use the fact that stacks are executable (in i386, at least). On Linux, they use INT 80 system calls to execute functions in the kernel as root, when the stack is smashed as a result of a