Re: Sabotaged PaXtest (was: Re: Patch 4/6 randomize the stack pointer)

pageexec
2005-02-08T12:27:51Z

> btw., do you consider PaX as a 100% sure solution against 'code
> injection' attacks (meaning that the attacker wants to execute an
> arbitrary piece of code, and assuming the attacked application has a
> stack overflow)? I.e. does PaX avoid all such attacks in a guaranteed
> way?

your question is answered in http://pax.grsecurity.net/docs/pax.txt
that i suggested you to read over a year ago. the short answer is
that it's not only about stack overflows but any kind of memory
corruption bugs, and you need both a properly configured kernel
(for PaX/i386 that would be SEGMEXEC/MPROTECT/NOELFRELOCS) and an
access control system (to take care of the file system and file
mappings) and a properly prepared userland (e.g., no text relocations
in ELF executables/libs, which is a good thing anyway).