About

Stack clash is an exploit which utilized large frame allocations to "jump the guard page" creating a scenario where the heap and stack collided under attacker control. This can be used to gain full control of a vulnerable application. Stack probing techniques can be used to mitigate the vast majority of vulnerabilities in this space, but implementing them requires significant work for each and every target to be supported.

Stack clash mitigations are a soft requirement for distributions such as Fedora and a hard requirement for Red Hat Enterprise Linux.

Plan is to start with a naive implementation that probes at the start of each function allocating stack space and each page beyond the first which gets allocated. Once naive probing works we'll go back and adjust for probing of the outgoing argument space per the ABI requirements. Once probing of the outgoing argument space is functional we can remove the explicit probe at the start of each function and only start probing with the function allocates PAGE_SIZE-1k or more of stack space.

Red Hat has agreed to make their annocheck code available which was used to test the stack clash mitigations on x86. We'll evaluate if that can be repurposed for RISC-V. If so, great, otherwise we'll do a by-hand scanner (which will probably be too fragile/ugly to release). The goal is to scan every executable and dynamic object available in a distro such as Canonical, Debian, Fedora and flag any sequences that look like they may violate the requirements for stack clash mitigation. Even the best scanners have had false positives, so we'll evaluate the output of whatever scanner tool we choose.

It is expected that this work will begin once Raphael has completed the GCC implementation.

Stakeholders/Partners

RISE:

Ventana: Raphael Zinsly, lead developer.

Ventana: Jeff Law, oversight

Red Hat: Nick Clifton (provided the old x86 scanner tool)

External:

Dependencies

Status

Development	COMPLETE
Development Timeline	NA
Upstreaming	DONE
Upstream Version
Contacts	Jeff Law (Ventana)
Dependencies	None

Updates

03 Feb 2025

All review issues have been addressed and final patches pushed into upstream LLVM.

14 Nov 2024

Raphael will be opening an MR imminently to start external review of the stack clash implementation

07 Nov 2024

Development work is complete
Raphael is working on another project for Ventana, so can't focus on upstreaming
Craig recommends posting it anyway for review

11 Jul 2024

Moved to 2H2024

05 Jun 2024

Basic work is considered complete
Currently porting tests from other architectures to work on RISC-V, fixing bugs that exposes
Hoping to start external review in the summer.

25 Apr 2024

Basic generation of probes is working in LLVM
Currently working on getting call-frame-information updated properly
After CFI fixes, need to add support for variable frames due to vector saves/restores

20 Mar 2024

Raphael just getting started on an LLVM implementation

28 Jun 2023

Project reported as priority for 1H2024.

Browser not supported