Patryk KrawaczyńskiNov 21, 2022
Stack Clash - kurs kolizyjny pamięci w systemach *nix ( https://nfsec.pl/security/5984 ). #linux #bsd #kernel #security #stackclash #twittermigration
NF.sec – Bezpieczeństwo systemu Linux - Stack Clash – kurs kolizyjny pamięci w systemach *nix

Czym jest Stack Clash? Jest to eksploatacja błędu w zarządzaniu pamięci oparta na dość starej (12 letniej) technice. Dotyka ona kilku systemów operacyjnych: Linuksa, OpenBSD, NetBSD, FreeBSD oraz Solarisa dla architektury i386 oraz amd64. Technika ta może zostać wykorzystana przez atakujących do naruszenia bezpieczeństwa pamięci oraz wykonania dowolnego kodu. Polega ona na pewnej zależności: każdy […]

TurtleCrazyJul 9, 2017
Sinon, la RC2 de #FreeeBSD est prête; Mis à part quelques correctifs, c'est la mise en place de barrières pour éviter les #stackclash qui est au menu
Shawn WebbJul 4, 2017
Thank you, #OPNsense, for yet another flawless upgrade to 17.1.9! It's nice to see the #HardenedBSD #StackClash mitigations made it in, too.
Shawn WebbJul 1, 2017
After my latest #StackClash fixup commits, I've started a new pkg exp-run for #HardenedBSD. I'm hoping I've got it all fixed after the major stack architecture changes #FreeBSD introduced.
Shawn WebbJul 1, 2017

So the latest #StackClash work done by #FreeBSD can cause a kernel panic if the user has set security.bsd.stack_guard_page > 1.

This has already been mitigated in #HardenedBSD by ensuring mmap(MAP_FIXED) requests are NOT within bounds of the stack.

Thomas B. RückerJun 29, 2017
#StackClash PoC/Exploits by #Qualys are now public
http://www.openwall.com/lists/oss-security/2017/06/28/14
Shawn WebbJun 28, 2017
The #StackClash PoCs are now available: https://www.qualys.com/research/security-advisories/ #FreeBSD #Linux #OpenBSD #Solaris #NetBSD
Shawn WebbJun 26, 2017

New build of #HardenedBSD for the #RPI3. It has all the fixes for #StackClash.

https://hardenedbsd.org/~shawn/rpi3/2017-06-26/HardenedBSD-RaspberryPi3-aarch64-12.0-HARDENEDBSD-NODEBUG-cb7b24b338f7.img.xz

#FreeBSD #infosec

HardenedBSDJun 25, 2017

We're happy to announce the #StackClash mitigations in #HardenedBSD: https://hardenedbsd.org/article/shawn-webb/2017-06-25/stack-clash-mitigations

#FreeBSD #infosec

Show threadShawn WebbJun 24, 2017

What could be done to improve it:

1. Don't allow unmapping of guard pages.
2. Don't allow remapping guard pages with MAP_FIXED.
3. Use MAP_GUARD with libthr's stack guard.
4. Increase the default size of the stack guard.

#FreeBSD #HardenedBSD #infosec #StackClash