Bài giảng An toàn hệ điều hành - OS Vulnerabilities

Download

OS Vulnerabilities

Background

ꢀ A process' address space is divided into four

"segments"

Buffer Overflows

ꢀ A buffer overflow is a weakness in code where the

bounds of an array (often a buffer) can be exceeded.

ꢀ An attacker will be able to write over other data in

memory and cause the code to do something it wasn't

supposed to

ꢀ Generally, this means that an attacker could coerce a

program into executing arbitrary code of the attacker's

choice.

Buffer Overflow: Stack Smashing

ꢀ The buffer being overflowed is located in the stack. In

other words, the buffer is a local variable in the code.

ꢀ As the stack-allocated buffer is filled from low to high

memory, an attacker can continue writing, right over top of

the return address on the stack

…

ꢀ If an attacker controls the exploited program's environment, they can put their

shellcode into an environment variable.

ꢀ Instead of making the new return address point to the overwritten buffer, the

attacker points the new return address to the environment variable's memory

location

Buffer Overflow: Frame Pointer

Overwriting

ꢀ The attack overwrites a byte of the saved frame

pointer

ꢀ When the called subroutine returns, it restores the

saved frame pointer from the stack; the caller's code

will then use that frame pointer value.

ꢀ After a frame pointer attack, the caller will have a

distorted view of where its stack frame is.

Buffer Overflow: Returns into Libraries

ꢀ If an attacker can't run arbitrary code, they can still run other

code

ꢀ Shared library code

ꢀ An attacker can overwrite a return address on the stack to point

to a shared library routine to execute

ꢀ For example, an attacker may call the system library routine,

which runs an arbitrary command.

ꢀ Arguments may be passed to library routines by the attacker by

writing beyond the return address in the stack

Buffer Overflow: Heap Overflows

ꢀ A heap overflow is a buffer overflow, where the buffer is located in the heap

or the data segment

ꢀ The idea is not to overwrite the return address or the saved frame pointer,

but to overwrite other variables that are adjacent to the buffer.

character buffer[123]

function pointer p

ꢀ Overflowing the buffer allows an attacker to change the value of the

function pointer p, which is the address of a function to call

ꢀ If the program performs a function call using p later, then it jumps to the

address the attacker specified; again, this allows an attacker to run arbitrary

code.

Buffer Overflow: Memory Allocator

Attacks

ꢀ One way heap overflows can be used is to attack the dynamic

memory allocator

ꢀ The allocator needs to maintain bookkeeping information

for each block of memory that it oversees in the heap

ꢀ When a program requests an X-byte block of memory, the

allocator reserves extra space:

• Before the block, room for bookkeeping information.

• After the block, space may be needed to round the block size up

ꢀ Exploiting a heap overflow in one block allows the

bookkeeping information for the following block to be

overwritten

There are two steps to unlink a node B

ꢀ An attacker exploits a heap overflow in the allocated

block immediately before B, and overwrites B’s list pointers

ꢀ B's previous pointer is set to the address of the attacker's

shellcode, and B's next pointer is assigned the address of a

code pointer that already exists in the program. For

example, this code pointer may be a return address on the

stack, or a function pointer in the data segment.

ꢀ The attacker then waits for the program to free the memory

block it overflowed

Integer Overflows

ꢀ In most programming languages, numbers do not have infinite precision.

ꢀ For instance, the range of integers may be limited to what can be encoded

in 16 bits

ꢀ Integer overflows, where a value "wraps around." For example, 30000 +

30000 = -5536.

ꢀ Sign errors. Mixing signed and unsigned numbers can lead to unexpected

results. The unsigned value 65432 is -104 when stored in a signed variable,

for instance

ꢀ Truncation errors, when a higher-precision value is stored in a variable with

lower precision. For example, the 32-bit value 8675309 becomes 24557 in

16 bits

ꢀ These effects can be exploited by an attacker - they are collectively called

integer overflow attacks

ꢀ Usually the attack isn't direct, but uses an integer overflow to cause other types

of weaknesses, like buffer overflows

n = input_number()

size = input_number()

totalsize = n * size

buffer = allocate_memory(totalsize)

i = 0

buffer_pointer = buffer

while i < n:

buffer_pointer _0…size-1= input_N_bytes(size)

buffer_pointer = buffer_pointer + size

i - i + 1

Tải về để xem bản đầy đủ

36 trang yennguyen 19740 Free

Download

Bạn đang xem 20 trang mẫu của tài liệu "Bài giảng An toàn hệ điều hành - OS Vulnerabilities", để tải tài liệu gốc về máy hãy click vào nút Download ở trên

File đính kèm:

bai_giang_an_toan_he_dieu_hanh_os_vulnerabilities.pdf