Date: Mon, 22 Oct 2018 20:31:02 +0000 From: Mikhail Klementev <jollheef@...eup.net> To: oss-security@...ts.openwall.com Subject: Re: GCC Compiler Induced Vulnerability - affects programs compiled with GCC 7 and 8 containing nested functions Hello, It was described in GCC documentation even from 2003: https://web.archive.org/web/20030207183940/http://gcc.gnu.org:80/onlinedocs/gccint/Trampolines.html What's difference between vulnerability you found and behavior that was described in the documentation? On Mon, Oct 22, 2018 at 03:07:55PM +0000, Andrew Sandoval wrote: > ... > Technical Description of the vulnerability > When nested C functions are compiled by GCC, code is generated which causes the > call stack of the currently executing thread to be made executable prior to the > call to a nested function and for the duration of the thread's lifetime. This > is essentially the equivalent of disabling Data Execution Prevention (DEP). > A stack overflow, etc., that is able to place instructions on the page(s) of > memory made executable has the potential of gaining execution and running > malware, etc. This places the process at substantial risk of being exploited. > ... -- With eval and apply, Mikhail Klementev. Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.