<<< Date Index >>>     <<< Thread Index >>>

Re: [ANNOUNCE] glibc heap protection patch



Hi Stefan,

On Dec 02, 2003, at 06:03, Stefan Esser wrote:
Nice advertisement but you should underline the fact, that it only
protects against glibc malloc()/free() problems. There are a number
of software packages that implement their own heap wrappers or work
with linked lists. They still are vulnerable to heap overflows.
f.e. PHP.

This is correct, and we state as much in our LISA paper. Apologies for not emphasizing it more in my post yesterday; I'll make sure the project page makes this clearer.

And on the other hand there is a much simpler way to protect any
unlink from a linked list from ever beeing exploited.

This is true in the case of the fd and bk pointers, and in fact this is one of the checks that dlmalloc's debugging code performs. However, as we also demonstrated in the paper, you are still open to other heap-related attacks, such as overwriting size fields and setting up fake chunk headers. So, unfortunately I don't think that check alone is sufficient.

Stefan Esser

--
William Robertson
Reliable Software Group, UC Santa Barbara
http://www.cs.ucsb.edu/~wkr/