...
Stack clash is an exploit which utilized large frame allocations to "jump the guard page" creating a scenario where the heap and stack collided under attacker control. This can be used to gain full control of a vulnerable application. Stack probing techniques can be used to mitigate the vast majority of vulnerabilities in this space, but implementing them requires significant work for each and every target to be supported.
Stack class clash mitigations are a soft requirement for distributions such as Fedora and a hard requirement for Red Hat Enterprise Linux.
...
| Page Properties | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Updates
- Raphael will be opening an MR imminently to start external review of the stack clash implementation
- Development work is complete
- Raphael is working on another project for Ventana, so can't focus on upstreaming
- Craig recommends posting it anyway for review
- Moved to 2H2024
- Basic work is considered complete
- Currently porting tests from other architectures to work on RISC-V, fixing bugs that exposes
- Hoping to start external review in the summer.
- Basic generation of probes is working in LLVM
- Currently working on getting call-frame-information updated properly
- After CFI fixes, need to add support for variable frames due to vector saves/restores
- Raphael just getting started on an LLVM implementation
- Project reported as priority for 1H2024.
...