CC_STACKPROTECTOR prevents Kernel stack overflow patch Analysis

CC_STACKPROTECTOR prevents Kernel stack overflow patch Analysis

By wzt <wzt.wzt@gmail.com>

The CC_STACKPROTECT patch is a patch that Tejun Heo submitted to the main line kernel in to prevent kernel stack overflow. The default config option is disabled. During kernel compilation,
Modify the. config file to CONFIG_CC_STACKPROTECTOR = y. In the future, the Apsara kernel can enable this option to prevent zero-day attacks that use kernel stack overflow.
The anti-overflow principle of this patch is: when the process starts, place a pre-configured stack canary behind each buffer. You can
Think of it as a sentry. When the buffer overflow occurs, it will definitely destroy the value of the stack canary. When the value of the stack canary is damaged, the kernel will directly act as a machine. So how to judge the stack canary
Is it overwritten? In fact, this is done by gcc. The kernel adds the-fstack-protector parameter to gcc during compilation. Let's first study what this parameter is.

First, write a simple program with overflow:
[Wzt @ localhost csaw] $ cat test. c
# Include <stdio. h>
# Include <stdlib. h>

Void test (void)
{
Char buff [64];

Memset (buff, 0x41,128); // copy 128 bytes to a 64-size buffer, and a buffer overflow will certainly occur.
}

Int main (void)
{
Test ();

Return 0;
}
[Wzt @ localhost csaw] $ gcc-o test. c
[Wzt @ localhost csaw] $./test
Segment Error

Disassembly:
[Wzt @ localhost csaw] $ objdump-d test> hex

08048384 <test>:
8048384: 55 push % ebp
8048385: 89 e5 mov % esp, % ebp
8048387: 83 ec 58 sub $0x58, % esp
804838a: c7 44 24 08 80 00 00 movl $0x80, 0x8 (% esp)
8048391: 00
8048392: c7 44 24 04 41 00 00 movl $0x41,0x4 (% esp)
8048399: 00
804839a: 8d 45 c0 lea 0xffffffc0 (% ebp), % eax
804839d: 89 04 24 mov % eax, (% esp)
80483a0: e8 e3 fe ff call 8048288 <memset @ plt>
80483a5: c9 leave
80483a6: c3 ret

Nothing special. Let's add the-fstack-protector parameter to see it:
[Wzt @ localhost csaw] $ gcc-o test. c-fstack-protector
[Wzt @ localhost csaw] $./test
* ** Stack smashing detected **:./test terminated
Abandoned
This time the program printed a stack overflow information and then automatically exited.

In the disassembly:
[Wzt @ localhost csaw] $ objdump-d test> hex1

080483d4 <test>:
80483d4: 55 push % ebp
80483d5: 89 e5 mov % esp, % ebp
80483d7: 83 ec 68 sub $0x68, % esp
80483da: 65 a1 14 00 00 mov % gs: 0x14, % eax
80483e0: 89 45 fc mov % eax, 0 xfffffffc (% ebp)
80483e3: 31 c0 xor % eax, % eax
80483e5: c7 44 24 08 80 00 00 movl $0x80, 0x8 (% esp)
80483ec: 00
80483ed: c7 44 24 04 41 00 00 movl $0x41,0x4 (% esp)
80483f4: 00
80483f5: 8d 45 bc lea 0 xffffffbc (% ebp), % eax
80483f8: 89 04 24 mov % eax, (% esp)
80483fb: e8 cc fe ff call 80482cc <memset @ plt>
8048400: 8b 45 fc mov 0 xfffffffc (% ebp), % eax
8048403: 65 33 05 14 00 00 00 xor % gs: 0x14, % eax
804840a: 74 05 je 8048411 <test + 0x3d>
804840c: e8 db fe ff call 80482ec <__ stack_chk_fail @ plt>
8048411: c9 leave
8048412: c3 ret

After the-fstack-protector parameter is used, gcc places several pieces of assembly code at the beginning of the function:
80483d7: 83 ec 68 sub $0x68, % esp
80483da: 65 a1 14 00 00 mov % gs: 0x14, % eax
80483e0: 89 45 fc mov % eax, 0 xfffffffc (% ebp)
The code segment gs offset 0x14 memory value assigned to the ebp-4, that is, after the first variable value.

After calling memeset, the following assembly code is available:
80483fb: e8 cc fe ff & nb