Stack buffer overflow

In software, a stack buffer overflow or stack buffer overrun occurs when a program writes to a memory address on the program's call stack outside of the intended data structure, which is usually a fixed-length buffer.^[1][2] Stack buffer overflow bugs are caused when a program writes more data to a buffer located on the stack than what is actually allocated for that buffer. This almost always results in corruption of adjacent data on the stack, and in cases where the overflow was triggered by mistake, will often cause the program to crash or operate incorrectly. Stack buffer overflow is a type of the more general programming malfunction known as buffer overflow (or buffer overrun).^[1] Overfilling a buffer on the stack is more likely to derail program execution than overfilling a buffer on the heap because the stack contains the return addresses for all active function calls.

A stack buffer overflow can be caused deliberately as part of an attack known as stack smashing. If the affected program is running with special privileges, or accepts data from untrusted network hosts (e.g. a webserver) then the bug is a potential security vulnerability. If the stack buffer is filled with data supplied from an untrusted user then that user can corrupt the stack in such a way as to inject executable code into the running program and take control of the process. This is one of the oldest and more reliable methods for attackers to gain unauthorized access to a computer.^[3][4][5]

Exploiting stack buffer overflows

The canonical method for exploiting a stack-based buffer overflow is to overwrite the function return address with a pointer to attacker-controlled data (usually on the stack itself).^[3][6] This is illustrated with strcpy() in the following example:

#include <string.h>

void foo(char* bar) {
    char c[12];

    strcpy(c, bar); // no bounds checking
}

int main(int argc, char* argv[]) {
    foo(argv[1]);
    return 0;
}

This code takes an argument from the command line and copies it to a local stack variable c. This works fine for command-line arguments smaller than 12 characters (as can be seen in figure B below). Any arguments larger than 11 characters long will result in corruption of the stack. (The maximum number of characters that is safe is one less than the size of the buffer here because in the C programming language, strings are terminated by a null byte character. A twelve-character input thus requires thirteen bytes to store, the input followed by the sentinel zero byte. The zero byte then ends up overwriting a memory location that's one byte beyond the end of the buffer.)

The program stack in foo() with various inputs:

In figure C above, when an argument larger than 11 bytes is supplied on the command line foo() overwrites local stack data, the saved frame pointer, and most importantly, the return address. When foo() returns, it pops the return address off the stack and jumps to that address (i.e. starts executing instructions from that address). Thus, the attacker has overwritten the return address with a pointer to the stack buffer char c[12], which now contains attacker-supplied data. In an actual stack buffer overflow exploit the string of "A"'s would instead be shellcode suitable to the platform and desired function. If this program had special privileges (e.g. the SUID bit set to run as the superuser), then the attacker could use this vulnerability to gain superuser privileges on the affected machine.^[3]

The attacker can also modify internal variable values to exploit some bugs. With this example:

#include <stdio.h>
#include <string.h>

void foo(char* bar) {
    float myFloat = 10.5; // Addr = 0x0023FF4C
    char c[28]; // Addr = 0x0023FF30

    // Will print 10.500000
    printf("myFloat value = %f\n", myFloat);

    /* ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       Memory map:
       @ : c allocated memory
       # : myFloat allocated memory

           *c                      *myFloat
       0x0023FF30                  0x0023FF4C
           |                           |
           @@@@@@@@@@@@@@@@@@@@@@@@@@@@#####
      foo("my string is too long !!!!! XXXXX");

    memcpy will put 0x1010C042 (little endian) in myFloat value.
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/

    memcpy(c, bar, strlen(bar));  // no bounds checking...

    // Will print 96.031372
    printf("myFloat value = %f\n", myFloat);
}

int main(int argc, char* argv[]) {
    foo("my string is too long !!!!! \x10\x10\xc0\x42");
    return 0;
}

There are typically two methods that are used to alter the stored address in the stack - direct and indirect. Attackers started developing indirect attacks, which have fewer dependencies, in order to bypass protection measures that were made to reduce direct attacks.^[7]

Platform-related differences

A number of platforms have subtle differences in their implementation of the call stack that can affect the way a stack buffer overflow exploit will work. Some machine architectures store the top-level return address of the call stack in a register. This means that any overwritten return address will not be used until a later unwinding of the call stack. Another example of a machine-specific detail that can affect the choice of exploitation techniques is the fact that most RISC-style machine architectures will not allow unaligned access to memory.^[8] Combined with a fixed length for machine opcodes, this machine limitation can make the technique of jumping to the stack almost impossible to implement (with the one exception being when the program actually contains the unlikely code to explicitly jump to the stack register).^[9][10]

Protection schemes

Over the years, a number of control-flow integrity schemes have been developed to inhibit malicious stack buffer overflow exploitation. These may usually be classified into three categories:

• Detect that a stack buffer overflow has occurred and thus prevent redirection of the instruction pointer to malicious code.
• Prevent the execution of malicious code from the stack without directly detecting the stack buffer overflow.
• Randomize the memory space such that finding executable code becomes unreliable.

Notable examples

• The Morris worm in 1988 spread in part by exploiting a stack buffer overflow in the Unix finger server.^[20]
• The Slammer worm in 2003 spread by exploiting a stack buffer overflow in Microsoft's SQL server.^[21]
• The Blaster worm in 2003 spread by exploiting a stack buffer overflow in Microsoft DCOM service.
• The Witty worm in 2004 spread by exploiting a stack buffer overflow in the Internet Security Systems BlackICE Desktop Agent.^[22]
• There are a couple of examples of the Wii allowing arbitrary code to be run on an unmodified system. The "Twilight hack" which involves giving a lengthy name to the main character's horse in The Legend of Zelda: Twilight Princess,^[23] and "Smash Stack" for Super Smash Bros. Brawl which involves using an SD card to load a specially prepared file into the in-game level editor. Though both can be used to execute any arbitrary code, the latter is often used to simply reload Brawl itself with modifications applied.^[24]

See also

• Cybercrime
• ExecShield
• Heap overflow
• Integer overflow
• NX bit – no-execute bit for areas of memory
• Security-Enhanced Linux
• Stack overflow – when the stack itself overflows
• Storage violation

References