full-disclosure - Re: Advantages of Stack Guard over Stack Shield

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAH8yC8kmozqoW6AFbvaW0_F=HsEMV7Bi+HFtQCUUEM7D_FyFYQ@mail.gmail.com>
Date: Mon, 21 Oct 2013 06:57:01 -0400
From: Jeffrey Walton <noloader@...il.com>
To: Jaydeep Solanki <jaydp17@...il.com>
Cc: Full Disclosure List <full-disclosure@...ts.grok.org.uk>
Subject: Re: Advantages of Stack Guard over Stack Shield

On Sun, Oct 20, 2013 at 9:33 AM, Jaydeep Solanki <jaydp17@...il.com> wrote:
> Hi,
>
> I would like to know why nowadays Stack Guard is used everywhere (example:
> ProPolice in GCC, /GS in Visual Studio) instead of Stack Shield.
>
> Both the approaches (i.e. Stack Guard & Stack Shield) provide an equal level
> of security.
>
> Any specific advantages of Stack Guard over Stack Shield ?
I believe Hiroaki Etoh work on Stack Smashong Protection (SSP) was
based upon his work on IBM's ProPolice. One of the changes made was
the rearrangement of the variables in the stack frame to make it more
difficult to avoid or circumvent the protection.

There were some other benefits too, but I don't recall them now. You
can find Hiroaki Etoh's patch submission here:
http://gcc.gnu.org/ml/gcc-patches/2001-06/msg01753.html.

You can see how "fine grained" the SSP being used is with:

$ gcc -dumpspecs

...

*link_ssp:
    %{fstack-protector:}

*ssp_default:
    %{!fno-stack-protector:%{!fstack-protector-all:
    %{!ffreestanding:%{!nostdlib:-fstack-protector}} }}

-fstack-protector guards vulnerable objects such as C-strings; while
-fstack-protector-all guards all objects in a stack frame. You would
use -fstack-protector-all on high risk source files, such as those
that parse input from the internet.

Related, you also want to see -Wl,-z,noexecstack during an audit. If
you are dealing with a PaX enabled kernel like Gentoo, you should also
desire -Wl,-z,noexecheap.

Finally, Debian has a pretty good page that discusses some of these
things at https://wiki.debian.org/Hardening.

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/