>
>
>
> IMPORTANT::
>
> Now, this leads to a way to have a truly secure system: an EXPAND-UP
> STACK. With an expand up stack, where the ESP increments rather than
> decrements on a push, you can not overwrite the return address with
> the address of your own function. This could probably be implementable
> as an ELF flag, or maybe as a separate "architecture" with its own set
> of compiled libraries (as the current system would not work, since you
> would be calling a library that uses an expand-down stack). The
> Intel architecture, at least, allows you to specify an expand-up
> stack via the descriptor table segment type flag by setting it up
> like a normal data segment.
>
> This may not be extremely feasible, but for firewalls etc. where Alan
> recommends the patch, there could be distributions built that use
> an expand-up stack, which basically eliminates the current
> system of buffer overflows, completely closing a hole that has been
> in existance since 1988.
>
Oops! I just realized that the expand-down vs. expand-up has
absolutely nothing to do with the way the ESP register works...
but this makes me wonder if such a stack is available on any
architectures? Hmm... sorry for wasting bandwidth, but
IMHO this would be a very good solution to the problem if it
is available on any architectures
Joseph Malicki
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html