Subject: Re: OOT: What is a stack?

From: "James P. Salsman" <[email-masked]>
Date: Mon, 30 Jul 2001 19:44:30 -0700 (PDT)

Rahmat,

Thank you for your questions about stacks.

Since the virtual memory management unit defines which segments are and 
are not executable, I think it is best to think of the stack as the 
memory which has been allocated to the MMU's "stack segment" instead of 
in terms of particular registers.

It turns out that the i386 MMU does have provisions for nonexecutable 
segments, and such safeguards for the stack are implemented in certain 
patches to Linux.  However, those patches break certain features of 
the GDB debugger, so they are not popular.  Also, it is rumored that 
certain unix signaling packages push legitimate code on to the stack, 
but they are sloppy, because there is a miniscule efficiency advantage 
to doing so, and the pitfalls are very bad.  (Every fixed-length buffer
becomes a potential security exploit.)

Maybe someone at Microsoft can tell us what happens to Windows when 
the stack segment is marked non-executable.  Does anything break?  At 
least the CodeRed worm would break, along with similar stack exploits.

Cheers,
James

> Date: Tue, 31 Jul 2001 09:15:54 +0700
> From: "Rahmat M. Samik-Ibrahim" <[email-masked]>
> To: MILIS Internet History <[email-masked]>
> CC: "James P. Salsman" <[email-masked]>
> Subject: OOT: What is a stack?
> 
> Hello:
> 
> I have no idea where to follow up this issue; hopefully this
> list is the best fit.
> 
> James P. Salsman wrote on the IETF list:
> 
> > Speaking of prevention measures, is there anything in 
> > i386 architecture which can prevetn execution of code 
> > on the stack, or is that exclusive to SPARCitecture?
> 
> I am not familiar with SPARC, cmiiw, it uses 32 multipurpose
> registers with a sliding window. Therefore, what is exactly
> "prevent execution of code on the stack" ?
> 
> Speaking of stack history, how many processors that actually
> call one of its register as a "stack pointer"? Intel 8XXX,
> Zilog, what else?
> 
> How about PDP-11, does R5 count as a stack pointer?
> How about HP-1000, where a return address was stored
> in the front of a subroutine (Jump save address)?
> 
> regards,
> 
> -- 
> Rahmat M. Samik-Ibrahim - VLSM-TJT - http://rms46.vlsm.org
> - Hi! How are you? I send you this in order to have advice

---

From: "James P. Salsman" <[email-masked]>
Date: Tue, 31 Jul 2001 13:06:15 -0700 (PDT)

> Date: Tue, 31 Jul 2001 14:57:44 -0400
> From: "David P. Reed" <[email-masked]>
> 
> Small issue: Return addresses of calling routines are on the stack, and 
> they don't require execute access to exploit.  Thus, every fixed length 
> buffer is indeed a potential exploit, whether or not you give "execute" 
> permission to the stack.
> 
> I sense a wish to "blame Microsoft" or "blame Intel" on this one.  Blame 
> the designers of "C" string handling routines, instead

On the contrary, branching to an arbitrary address is very rarely even 
a significant capability in comparison to an executable exploit.  It 
might work in conjunction with a seperate exploit, but not by its self.

Is there any question that the decsions of operating systems 
architects, as to whether they allow code execution from the stack, are 
having a significant impact on the history of the internet?

There ought to be a Plumbing and Building Code for Internet-connected 
hosts. If your hardware forces you to have an executable stack, then you 
need better hardware.

Cheers,
James