Hacker News new | past | comments | ask | show | jobs | submit login

Return Oriented Programming (ROP) can bypass the non-executable stack protection, since existing "gadgets" from program memory are executed rather than attacker-provided shellcode.

However the stack protection will probably require a separate information leak (to find the canary value) or arbitrary write (to overwrite it) to bypass. Unless the attacker is fortunate to find an unprotected function which the compiler missed, or a value that can be overwritten which changes the control flow and isn't protected by the canary.

ASLR is also a decent mitigation against ROP, and requires an information leak so the exploit code can calculate the memory offset to find the library gadgets.

In short, ROP isn't the solution to all the mitigations the parent posted; in fact ASLR is designed to make ROP harder to exploit.




> Unless the attacker is fortunate to find an unprotected function which the compiler missed,

Every instance of the bytes C3, CB, C2 or CA in the executable page could potentially be abused, via carefully-chosen instruction alignment.


And, if your hardware supports it, PAC and shadow stacks can help protect your return addresses too.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: