Buffer Overflows - Revision history

EMeisl: Improve spelling

2024-12-11T18:18:27Z

Improve spelling

Show changes

AKofranek: /* Further Reading */

2024-12-11T17:29:29Z

AKofranek: /* References */

2024-12-11T17:22:28Z

References

← Older revision		Revision as of 17:22, 11 December 2024
Line 262:		Line 262:

	<references />		<references />

			=== Further Reading ===

	* [http://phrack.org/issues/49/14.html Smashing the stack for fun and profit (1996, Aleph One)]		* [http://phrack.org/issues/49/14.html Smashing the stack for fun and profit (1996, Aleph One)]

AKofranek: /* Types of Buffer Overflow Vulnerabilities */

2024-12-11T17:16:36Z

Types of Buffer Overflow Vulnerabilities

← Older revision		Revision as of 17:16, 11 December 2024
Line 111:		Line 111:
	== Types of Buffer Overflow Vulnerabilities ==		== Types of Buffer Overflow Vulnerabilities ==

	The following section will introduce descriptions and simple examples related to the most relevant categories of buffer overflow vulnerabilities. The distinction between Buffer Over-Read and Buffer Over-Write provides a basic categorization of the issues at hand. The respective sections will include simple, illustrative examples. The sections on Stack Buffer Overflow and Heap Buffer Overflow will present more complex ~~examples~~, ~~where~~ the mechanics and control structures of each memory region ~~are~~ exploited. Note that Over-Read and Over-Write vulnerabilities can occur in both sections of process memory.		The following section will introduce descriptions and simple examples related to the most relevant categories of buffer overflow vulnerabilities. The distinction between Buffer Over-Read and Buffer Over-Write provides a basic categorization of the issues at hand. The respective sections will include simple, illustrative examples. The sections on Stack Buffer Overflow and Heap Buffer Overflow will present more complex concepts, introducing the mechanics and control structures of each memory region and how they could potentially be exploited. Note that Over-Read and Over-Write vulnerabilities can occur in both sections of process memory.

	=== Buffer Over-Read ===		=== Buffer Over-Read ===

AKofranek: /* Heap-based Buffer Overflow */

2024-12-11T17:12:10Z

Heap-based Buffer Overflow

← Older revision		Revision as of 17:12, 11 December 2024
Line 202:		Line 202:
	Special system calls brk() and mmap() can be used by Linux programs to achieve that.		Special system calls brk() and mmap() can be used by Linux programs to achieve that.
	The functions malloc(), calloc(), realloc() and free() provide convenient wrapper functions around these system calls and help managing those memory segments. <ref name=”RE1”/>		The functions malloc(), calloc(), realloc() and free() provide convenient wrapper functions around these system calls and help managing those memory segments. <ref name=”RE1”/>

			To be efficient, any malloc() implementation stores a
			lot of meta-data about the location of the chunks, the size of the chunks, and perhaps
			some special areas for small chunks. It also organizes this information. In dlmalloc, it is
			organized into buckets, and in many other malloc implementations it is organized into
			a balanced tree structure. This information is stored in two places: in global variables
			used by the malloc() implementation itself, and in the memory block before and / or
			after the allocated user space. Thus, the heap contains important information about
			the state of memory stored directly after any user-allocated buffer. <ref name=”RE1”/>

	=== Use-After-Free Vulnerability ===		=== Use-After-Free Vulnerability ===

AKofranek: /* Heap-based Buffer Overflow */

2024-12-11T17:09:04Z

Heap-based Buffer Overflow

← Older revision		Revision as of 17:09, 11 December 2024
Line 199:		Line 199:

	=== Heap-based Buffer Overflow ===		=== Heap-based Buffer Overflow ===
	A program may not know at compile time how much memory it will need. Such ~~seg-~~		A program may not know at compile time how much memory it will need. Such segments can be allocated dynamically, during runtime, and will be placed on the heap.
	~~ments~~ can be allocated dynamically, during runtime, and will be placed on the heap.
	Special system calls brk() and mmap() can be used by Linux programs to achieve that.		Special system calls brk() and mmap() can be used by Linux programs to achieve that.
	The functions malloc(), calloc(), realloc() and free() provide convenient wrapper ~~func-~~		The functions malloc(), calloc(), realloc() and free() provide convenient wrapper functions around these system calls and help managing those memory segments. <ref name=”RE1”/>
	~~tions~~ around these system calls and help managing those memory segments. <ref name=”RE1”/>

	=== Use-After-Free Vulnerability ===		=== Use-After-Free Vulnerability ===

AKofranek: /* Heap-based Buffer Overflow */

2024-12-11T17:08:42Z

Heap-based Buffer Overflow

← Older revision		Revision as of 17:08, 11 December 2024
Line 199:		Line 199:

	=== Heap-based Buffer Overflow ===		=== Heap-based Buffer Overflow ===
			A program may not know at compile time how much memory it will need. Such seg-
			ments can be allocated dynamically, during runtime, and will be placed on the heap.
			Special system calls brk() and mmap() can be used by Linux programs to achieve that.
			The functions malloc(), calloc(), realloc() and free() provide convenient wrapper func-
			tions around these system calls and help managing those memory segments. <ref name=”RE1”/>

	=== Use-After-Free Vulnerability ===		=== Use-After-Free Vulnerability ===

AKofranek: /* Buffer Over-Write */

2024-12-11T17:01:40Z

Buffer Over-Write

← Older revision		Revision as of 17:01, 11 December 2024
Line 161:		Line 161:
	</pre>		</pre>

	Inspection of memory before the overflow. The memory addresses on the left are the locations of the two buffers.		Inspection of memory before the overflow (gdb).
			The memory addresses on the left are the locations of the two buffers.
	<pre>		<pre>
	0xffffcc85: 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x00		0xffffcc85: 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x00
Line 167:		Line 168:
	</pre>		</pre>

	Inspection of memory after the overflow.		Inspection of memory after the overflow (gdb).
	<pre>		<pre>
	0xffffcc85: 0x65 0x78 0x63 0x65 0x73 0x73 0x69 0x76		0xffffcc85: 0x65 0x78 0x63 0x65 0x73 0x73 0x69 0x76

AKofranek: /* Buffer Over-Write */

2024-12-11T17:01:10Z

Buffer Over-Write

@@ Line 133: / Line 133: @@
 === Buffer Over-Write ===
-In this section, a simple Out-of-bounds Write vulnerability will be examined. The following program deliberately uses the insecure strcpy()-function to copy a large string into a buffer, which is actually too small for the string. The following listing displays the complete source code.
+In this section, a simple Out-of-bounds write vulnerability will be examined. Although this particular example showcases a stack-based buffer overflow, we will use it to introduce the general concept of a over-write vulnerability and delve into specifically exploiting the stack's mechanics and control structures in the later section "Stack-based Buffer Overflow".
 <pre>
@@ Line 151: / Line 153: @@
      return 0;
+}
 </pre>

AKofranek: /* IoT/Embedded Devices */

2024-12-11T16:48:52Z

IoT/Embedded Devices

← Older revision		Revision as of 16:48, 11 December 2024
Line 95:		Line 95:

	=== IoT/Embedded Devices ===		=== IoT/Embedded Devices ===
	"The constrained resources of embedded systems leads to the predominant use of the C language. This, along with the tight processing requirements, leave associated devices open to BOF based attacks."		"The constrained resources of embedded systems leads to the predominant use of the C language. This, along with the tight processing requirements, leave associated devices open to BOF based attacks." <ref name=””> G. Mullen and L. Meany, "Assessment of Buffer Overflow Based Attacks On an IoT Operating System," 2019 Global IoT Summit (GIoTS), Aarhus, Denmark, 2019, pp. 1-6, doi: 10.1109/GIOTS.2019.8766434.
			</ref>
	G. Mullen and L. Meany, "Assessment of Buffer Overflow Based Attacks On an IoT Operating System," 2019 Global IoT Summit (GIoTS), Aarhus, Denmark, 2019, pp. 1-6, doi: 10.1109/GIOTS.2019.8766434.
	~~keywords: {Registers;Buffer overflows;Embedded systems;Internet of Things;Thumb;Instruction sets;Internet of Things;Operating Systems;Embedded systems;Security;Buffer Overflows;FreeRTOS;ARM},~~

	== Dangers ==		== Dangers ==

← Older revision		Revision as of 17:29, 11 December 2024
Line 266:		Line 266:

	* [http://phrack.org/issues/49/14.html Smashing the stack for fun and profit (1996, Aleph One)]		* [http://phrack.org/issues/49/14.html Smashing the stack for fun and profit (1996, Aleph One)]
			* [http://phrack.org/issues/57/8.html Vudo malloc tricks (2001, MaXX)]
	* [http://phrack.org/issues/60/10.html#article Basic Integer Overflows (2002, Blexim)]		* [http://phrack.org/issues/60/10.html#article Basic Integer Overflows (2002, Blexim)]
	* [https://doi.org/10.1109/SP.2013.45 Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization (2013, Snow et al.)]		* [https://doi.org/10.1109/SP.2013.45 Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization (2013, Snow et al.)]