Understanding and Preventing Buffer Overflow Attacks in Unix Alan Cox Appalachian State University April 29, 2002

Introduction What are buffer overflow attacks? How much of a threat do they pose? How do they work? What do you do to prevent them?

What are buffer overflow attacks? Provide an opportunity for a non-privileged user to execute arbitrary code as a privileged user. Attack can be made remotely using the Internet, or locally by a user with a shell account, etc.

How much of a threat do they pose? One of the most common security vulnerability over the past ten years. Many operating systems vulnerable. It is possible for an attacker to take complete control of a host.

Background UNIX permissions UNIX processes and stack

UNIX Permissions Multi-user operating system. One user ‘root’ is super-user and can do anything. Processes usually run with privilege of the user who started it. ‘Sticky bit’ allows a program to run with privilege of user who owns executable.

UNIX Processes and Stack Processes stored in three parts Text Data Stack Text area: - stores program code Data area: - two parts: initialized data and uninitialized data At execution: - text & data loaded into primary memory - all instances of a program share same text area - seg fault if write to text - each process has its own data and stack areas Stack: - zero-filled - first in – last out - dynamically allocated at runtime Two parts of stack: - heap: just above uninitialized data - user stack: lives above heap User stack: - contains many stack frames – each representing a function call - each frame has: function params, local vars, info to get back to what called function (incl. Instruction pointer)

Exploiting Buffer Overflows Buffer overflows are common in C/C++. This gives a segmentation fault. What happens? strcpy does not perform any array bounds checking continues to write the contents of str, even after it has exhausted the memory allocation of buffer. buffer lives in a stack frame beside the instruction pointer that specifies the instruction that follows the function call. In this case, the IP would contain the address of the first instruction that would execute the return 0 statement. When strcpy overflows buffer, it overwrites the contents of the instruction pointer. When foo finishes, the processor tries to execute the instruction living at the address specified by the instruction pointer. “The running process can no longer fetch the next instruction from the proper address, overwritten with an address outside its process space, returning a segmentation fault. [4]”

Exploiting Buffer Overflows If a malicious user is able to overwrite the IP with the address of specific code, the processor will execute that code. ‘shellcode’ is a string that represents valid instructions

Exploiting Buffer Overflows Previous example not very realistic – programmers shouldn’t put something like ‘shellcode’ in their programs. How, then, does an attacker get ‘shellcode’ into memory? Manipulating command-line arguments Manipulating environmental variables Interactive input

Preventing Buffer Overflows Reduce number of programs SUID root. Writing better programs Use strncat() rather than strcat(), etc. Check all user input Modify compilers (i.e. StackGuard) Use development tools such as LCLint