Re: Some questions about VM flags

Robert Hancock
2005-03-24T01:48:16Z

Luca Falavigna wrote:
> Shouldn't printf generate a segfault trying to read a variabile located in a
> write-only area?

What architecture is this on? On many CPUs it is not possible to enforce
a write-only memory area in most cases (there is no way to give write
permissions without giving read permissions).

>
> Shellcode lies in this segment. It is executed even if VM_EXEC isn't set. I
> think execution shouldn't be permitted if only VM_READ or VM_WRITE flags are
> set. Buffer overflows/format string based exploits wouldn't be so popular if we
> implemented this feaure. Please let me know your opinion.

Likewise, many CPUs cannot enforce execution restrictions separate from
read restrictions (x86 CPUs are like this, except for the latest ones
with NX support, or if you're using a kernel patch like exec-shield that
tries to emulate this support).

--
Robert Hancock Saskatoon, SK, Canada
To email, remove "nospam" from hancockr@nospamshaw.ca
Home Page: http://www.roberthancock.com/