Chrome 0-day exploit used in Operation WizardOpium

Re:Chrome 0-day exploit used in Operation WizardOpium by lovelearning on Saturday November 02, 2019 @04:01AM (#21426438)

As I understand these RCEs (in general; perhaps not this particular one), a frequent root cause seems to be saving instruction pointer on the stack adjacent to untrustworthy data which may have propagated down the call chain. Are there no initiatives being attempted to change this convention? Like not save the IP on the stack? Perhaps at the CPU architecture level or at the compiler level?

[ Parent | on HN ]

Re:Chrome 0-day exploit used in Operation WizardOpium by panpanna on Saturday November 02, 2019 @04:15AM (#21426483)

Wikipedia ROP article has a whole section on defense techniques

https://en.m.wikipedia.org/wiki/Return-oriented_programming

Note that this was a heap attack (free after use)

[ Parent | on HN ]

Re:Chrome 0-day exploit used in Operation WizardOpium by haecceity on Saturday November 02, 2019 @04:39AM (#21426556)

Control flow integrity is the group of techniques meant to deal with this problem. There are settings for Microsoft’s cpp compiler to enable them but the best way to accomplish this is with a hardware shadow stack. Intel cet does this but I’m not sure when the hardware will be available.

[ Parent | on HN ]

Re:Chrome 0-day exploit used in Operation WizardOpium by cjbprime on Saturday November 02, 2019 @04:50AM (#21426591)

There are already many modern mitigations present to defeat the kind of stack overflow control of the instruction pointer that you're imagining -- stack canaries, DEP, ASLR, NX, and others.

Simply gaining control of the instruction pointer through a stack overflow as you describe stopped working a decade or so ago due to these mitigations.

[ Parent | on HN ]

Re:Chrome 0-day exploit used in Operation WizardOpium by saagarjha on Saturday November 02, 2019 @10:39AM (#21427938)

DEP and NX are essentially the same thing, FYI.

[ Parent | on HN ]

Re:Chrome 0-day exploit used in Operation WizardOpium by Karliss on Saturday November 02, 2019 @04:10AM (#21426467)

There is SafeStack https://clang.llvm.org/docs/SafeStack.html which splits stack in to two parts.

[ Parent | on HN ]

Re:Chrome 0-day exploit used in Operation WizardOpium by lawnchair_larry on Saturday November 02, 2019 @04:13AM (#21426475)

This is completely unrelated to this class of issue. You’re thinking of stack-based buffer overlows. This is all about heap manipulation, and doesn’t involve an overflow. Not in that sense anyway.

[ Parent | on HN ]