[PPT] - Buffer Overflow overflows Defenses and other memory safety PowerPoint Presentation

SLIDE 1

This time

Everything you’ve always wanted to know about

gdb but were too afraid to ask

Overflow defenses
Other memory safety vulnerabilities

Buffer

verflows

We will continue

and other memory safety vulnerabilities

By looking at

Overflow

Defenses

SLIDE 2

gdb: your new best friend

i f i r x/<n> <addr> b <function>  s Set a breakpoint at <function>  step through execution (into calls) Examine <n> bytes of memory  starting at address <addr> Show info about registers  (%ebp, %eip, %esp, etc.) Show info about the current frame  (prev. frame, locals/args, %ebp/%eip)

SLIDE 3

Recall our challenges

Putting code into the memory (no zeroes)
Getting %eip to point to our code (dist buff to stored eip)
Finding the return address (guess the raw addr)

How can we make these even more difficult?

SLIDE 4

Detecting overflows with canaries

00 00 00 00

buffer

Text

%eip

...

&arg1 %eip

%ebp

…

SLIDE 5

Detecting overflows with canaries

00 00 00 00

buffer

Text

%eip

...

&arg1 %eip

%ebp

…

SLIDE 6

Detecting overflows with canaries

00 00 00 00

buffer

Text

%eip

...

&arg1 %eip

%ebp

… 02 8d e2 10

canary

SLIDE 7

Detecting overflows with canaries

00 00 00 00

buffer

Text

%eip

...

&arg1 %eip

%ebp

… 02 8d e2 10

canary

nop nop nop …

0xbdf

\x0f \x3c \x2f ...

SLIDE 8

Detecting overflows with canaries

00 00 00 00

buffer

Text

%eip

...

&arg1 %eip

%ebp

… 02 8d e2 10

canary

nop nop nop …

0xbdf

\x0f \x3c \x2f ...

SLIDE 9

Detecting overflows with canaries

00 00 00 00

buffer

Text

%eip

...

&arg1 %eip

%ebp

… 02 8d e2 10

canary

nop nop nop …

0xbdf

\x0f \x3c \x2f ...

Not the expected value: abort

SLIDE 10

Detecting overflows with canaries

00 00 00 00

buffer

Text

%eip

...

&arg1 %eip

%ebp

… 02 8d e2 10

canary

nop nop nop …

0xbdf

\x0f \x3c \x2f ...

Not the expected value: abort What value should the canary have?

SLIDE 11

Canary values

1. Terminator canaries (CR, LF, NULL, -1)
Leverages the fact that scanf etc. don’t allow these
2. Random canaries
Write a new random value @ each process start
Save the real value somewhere in memory
Must write-protect the stored value
3. Random XOR canaries
Same as random canaries
But store canary XOR some control info, instead

From StackGuard [Wagle & Cowan]

SLIDE 12

Recall our challenges

Putting code into the memory (no zeroes)
Option: Make this detectable with canaries 
Getting %eip to point to our code(dist buff to stored eip)
Finding the return address (guess the raw addr)

How can we make these even more difficult? More next time…

SLIDE 13

Return-to-libc

&arg1 %eip

%ebp

00 00 00 00

buffer

Text

%eip

...

…

nop nop nop …

nop sled

0xbdf

good  guess padding

\x0f \x3c \x2f ...

malicious code libc

SLIDE 14

Return-to-libc

&arg1 %eip

%ebp

00 00 00 00

buffer

Text

%eip

...

…

nop nop nop …

nop sled

0xbdf

good  guess padding libc

SLIDE 15

Return-to-libc

&arg1 %eip

%ebp

00 00 00 00

buffer

Text

%eip

...

…

0xbdf

good  guess padding libc

SLIDE 16

Return-to-libc

&arg1 %eip

%ebp

00 00 00 00

buffer

Text

%eip

...

…

padding libc

SLIDE 17

Return-to-libc

&arg1 %eip

%ebp

00 00 00 00

buffer

Text

%eip

...

…

padding libc

exec()

... ...

printf()

...

“/bin/sh”

libc

SLIDE 18

Return-to-libc

&arg1 %eip

%ebp

00 00 00 00

buffer

Text

%eip

...

…

padding

0x17f

known  location libc

exec()

... ...

printf()

...

“/bin/sh”

libc

SLIDE 19

Return-to-libc

&arg1 %eip

%ebp

00 00 00 00

buffer

Text

%eip

...

…

padding

0x17f

known  location

0x20d

libc

exec()

... ...

printf()

...

“/bin/sh”

libc

SLIDE 20

Recall our challenges

Putting code into the memory (no zeroes)
Option: Make this detectable with canaries 
Getting %eip to point to our code (dist buff to stored eip)
Non-executable stack doesn’t work so well
Finding the return address (guess the raw addr)

How can we make these even more difficult?

SLIDE 21

Address Space Layout Randomization (ASLR)

Basic idea: change the layout of the stack
Slow to adopt
Linux in 2005
Vista in 2007 (off by default for compatibility with
lder software
OS X in 2007 (for system libraries), 2011 for all apps
iOS 4.3 (2011)
Android 4.0
FreeBSD: no

How would you overcome this as an attacker?

SLIDE 22

Overflow defenses summary

Putting code into the memory (no zeroes)
Option: Make this detectable with canaries 
Getting %eip to point to our code (dist buff to stored eip)
Non-executable stack doesn’t work so well 
Finding the return address (guess the raw addr)
Address Space Layout Randomization (ASLR)
Many systems slow to adopt; also, how could you get around this?
Good coding practices

SLIDE 23

Last time

Finish overflow attacks & other vulnerabilities
Overflow defenses
Everything you’ve always wanted to know about

gdb but were too afraid to ask

Buffer

verflows

We continued

and other memory safety vulnerabilities

By looking at

Overflow

Defenses

SLIDE 24

This time

Required reading:

“StackGuard: Simple Stack Smash Protection for GCC” Optional reading: “Basic Integer Overflows” “Exploiting Format String Vulnerabilities”

Secure 

Code

Writing & testing for

Continuing with

Software

Security

http://nob.cs.ucdavis.edu/bishop/secprog/robust.html

SLIDE 25

Cat and mouse

SLIDE 26

Cat and mouse

Defense: Make stack/heap non-executable to prevent

injection of code

SLIDE 27

Cat and mouse

Defense: Make stack/heap non-executable to prevent

injection of code

Attack response: Return to libc

SLIDE 28

Cat and mouse

Defense: Make stack/heap non-executable to prevent

injection of code

Attack response: Return to libc
Defense: Hide the address of desired libc code or

return address using ASLR

SLIDE 29

Cat and mouse

Defense: Make stack/heap non-executable to prevent

injection of code

Attack response: Return to libc
Defense: Hide the address of desired libc code or

return address using ASLR

Attack response: Brute force search (for 32-bit systems)
r information leak (format string vulnerability: later today)

SLIDE 30

Cat and mouse

Defense: Make stack/heap non-executable to prevent

injection of code

Attack response: Return to libc
Defense: Hide the address of desired libc code or

return address using ASLR

Attack response: Brute force search (for 32-bit systems)
r information leak (format string vulnerability: later today)
Defense: Avoid using libc code entirely and use code in

the program text instead

SLIDE 31

Cat and mouse

Defense: Make stack/heap non-executable to prevent

injection of code

Attack response: Return to libc
Defense: Hide the address of desired libc code or

return address using ASLR

Attack response: Brute force search (for 32-bit systems)
r information leak (format string vulnerability: later today)
Defense: Avoid using libc code entirely and use code in

the program text instead

Attack response: Construct needed functionality using

return oriented programming (ROP)

SLIDE 32

Return oriented programming (ROP)

SLIDE 33

Return-oriented Programming

SLIDE 34

Return-oriented Programming

Introduced by Hovav Shacham in 2007
The Geometry of Innocent Flesh on the Bone:

Return-into-libc without Function Calls (on the x86), CCS’07

SLIDE 35

Return-oriented Programming

Introduced by Hovav Shacham in 2007
The Geometry of Innocent Flesh on the Bone:

Return-into-libc without Function Calls (on the x86), CCS’07

Idea: rather than use a single (libc) function to run

your shellcode, string together pieces of existing code, called gadgets, to do it instead

SLIDE 36

Return-oriented Programming

Introduced by Hovav Shacham in 2007
The Geometry of Innocent Flesh on the Bone:

Return-into-libc without Function Calls (on the x86), CCS’07

Idea: rather than use a single (libc) function to run

your shellcode, string together pieces of existing code, called gadgets, to do it instead

Challenges
Find the gadgets you need
String them together

SLIDE 37

Approach

SLIDE 38

Approach

Gadgets are instruction groups that end

with ret

SLIDE 39

Approach

Gadgets are instruction groups that end

with ret

Stack serves as the code
%esp = program counter
Gadgets invoked via ret instruction
Gadgets get their arguments via pop,

etc.

Also on the stack

SLIDE 40

Simple example

0xffffffff 0x00 mov %edx, 5

equivalent to

%edx

SLIDE 41

Simple example

0x17f: pop %edx ret 0xffffffff 0x00 Text mov %edx, 5

equivalent to

%edx

Gadget

SLIDE 42

Simple example

0x17f: pop %edx ret 5 0x17f 0xffffffff 0x00 Text mov %edx, 5 …

equivalent to

%edx

next gadget

Gadget “Instructions”

SLIDE 43

Simple example

0x17f: pop %edx ret 5 0x17f 0xffffffff 0x00 Text mov %edx, 5 …

equivalent to

%eip

%edx

next gadget

%esp

Gadget “Instructions” “program counter”

(ret)

SLIDE 44

Simple example

0x17f: pop %edx ret 5 0x17f 0xffffffff 0x00 Text mov %edx, 5 …

equivalent to

%eip

%edx

next gadget

%esp (ret)

SLIDE 45

Simple example

0x17f: pop %edx ret 5 0x17f 0xffffffff 0x00 Text mov %edx, 5 …

equivalent to

%eip

%edx

5

next gadget

%esp (ret)

SLIDE 46

Simple example

0x17f: pop %edx ret 5 0x17f 0xffffffff 0x00 Text mov %edx, 5 …

equivalent to

%eip

%edx

5

next gadget

%esp (ret)

SLIDE 47

Code sequence

0xffffffff 0x00 0x404 … … 5 …

%eax %ebx

… %esp 0x17f: mov %eax, [%esp] mov %ebx, [%esp-8] mov [%ebx], %eax %eip 0x404 Text

SLIDE 48

Code sequence

0xffffffff 0x00 0x404 … … 5 …

%eax %ebx

… %esp 0x17f: mov %eax, [%esp] mov %ebx, [%esp-8] mov [%ebx], %eax %eip 0x404 Text 5

SLIDE 49

Code sequence

0xffffffff 0x00 0x404 … … 5 …

%eax %ebx

… %esp 0x17f: mov %eax, [%esp] mov %ebx, [%esp-8] mov [%ebx], %eax %eip 0x404 Text 5 0x404

SLIDE 50

Code sequence

0xffffffff 0x00 0x404 … … 5 …

%eax %ebx

… %esp 0x17f: mov %eax, [%esp] mov %ebx, [%esp-8] mov [%ebx], %eax %eip 0x404 Text 5 0x404 5

SLIDE 51

Equivalent ROP sequence

0xffffffff 0x00 0x404 0x20d 0x21a 5 …

%eax %ebx

… %esp 0x17f: pop %eax ret … 0x20d: pop %ebx ret … 0x21a: mov [%ebx], %eax %eip 0x404 Text

SLIDE 52

Equivalent ROP sequence

0xffffffff 0x00 0x404 0x20d 0x21a 5 …

%eax %ebx

… %esp 0x17f: pop %eax ret … 0x20d: pop %ebx ret … 0x21a: mov [%ebx], %eax %eip 0x404 Text 5

SLIDE 53

Equivalent ROP sequence

0xffffffff 0x00 0x404 0x20d 0x21a 5 …

%eax %ebx

… %esp 0x17f: pop %eax ret … 0x20d: pop %ebx ret … 0x21a: mov [%ebx], %eax %eip 0x404 Text 5

SLIDE 54

Equivalent ROP sequence

0xffffffff 0x00 0x404 0x20d 0x21a 5 …

%eax %ebx

… %esp 0x17f: pop %eax ret … 0x20d: pop %ebx ret … 0x21a: mov [%ebx], %eax %eip 0x404 Text 5 0x404

SLIDE 55

Equivalent ROP sequence

0xffffffff 0x00 0x404 0x20d 0x21a 5 …

%eax %ebx

… 0x17f: pop %eax ret … 0x20d: pop %ebx ret … 0x21a: mov [%ebx], %eax %eip 0x404 Text 5 0x404

SLIDE 56

Equivalent ROP sequence

0xffffffff 0x00 0x404 0x20d 0x21a 5 …

%eax %ebx

… 0x17f: pop %eax ret … 0x20d: pop %ebx ret … 0x21a: mov [%ebx], %eax %eip 0x404 Text 5 0x404 5

SLIDE 57

Image by Dino Dai Zovi

SLIDE 58

Whence the gadgets?

SLIDE 59

Whence the gadgets?

How can we find gadgets to construct an exploit?

SLIDE 60

Whence the gadgets?

How can we find gadgets to construct an exploit?
Automate a search of the target binary for gadgets (look for ret

instructions, work backwards)

Cf. https://github.com/0vercl0k/rp

SLIDE 61

Whence the gadgets?

How can we find gadgets to construct an exploit?
Automate a search of the target binary for gadgets (look for ret

instructions, work backwards)

Cf. https://github.com/0vercl0k/rp
Are there sufficient gadgets to do anything interesting?

SLIDE 62

Whence the gadgets?

How can we find gadgets to construct an exploit?
Automate a search of the target binary for gadgets (look for ret

instructions, work backwards)

Cf. https://github.com/0vercl0k/rp
Are there sufficient gadgets to do anything interesting?
Yes: Shacham found that for significant codebases (e.g.,

libc), gadgets are Turing complete

Especially true on x86’s dense instruction set

SLIDE 63

Whence the gadgets?

How can we find gadgets to construct an exploit?
Automate a search of the target binary for gadgets (look for ret

instructions, work backwards)

Cf. https://github.com/0vercl0k/rp
Are there sufficient gadgets to do anything interesting?
Yes: Shacham found that for significant codebases (e.g.,

libc), gadgets are Turing complete

Especially true on x86’s dense instruction set
Schwartz et al (USENIX Security ’11) have automated

gadget shellcode creation, though not needing/requiring Turing completeness

SLIDE 64

Blind ROP

SLIDE 65

Blind ROP

Defense: Randomizing the location of the code

(by compiling for position independence) on a 64- bit machine makes attacks very difficult

SLIDE 66

Blind ROP

Defense: Randomizing the location of the code

(by compiling for position independence) on a 64- bit machine makes attacks very difficult

Recent, published attacks are often for 32-bit

versions of executables

SLIDE 67

Blind ROP

Defense: Randomizing the location of the code

(by compiling for position independence) on a 64- bit machine makes attacks very difficult

Recent, published attacks are often for 32-bit

versions of executables

Attack response: Blind ROP

SLIDE 68

Blind ROP

Defense: Randomizing the location of the code

(by compiling for position independence) on a 64- bit machine makes attacks very difficult

Recent, published attacks are often for 32-bit

versions of executables

Attack response: Blind ROP

If server restarts on a crash, but does not re-randomize:

SLIDE 69

Blind ROP

Defense: Randomizing the location of the code

(by compiling for position independence) on a 64- bit machine makes attacks very difficult

Recent, published attacks are often for 32-bit

versions of executables

Attack response: Blind ROP

If server restarts on a crash, but does not re-randomize: 1.Read the stack to leak canaries and a return address

SLIDE 70

Blind ROP

Defense: Randomizing the location of the code

(by compiling for position independence) on a 64- bit machine makes attacks very difficult

Recent, published attacks are often for 32-bit

versions of executables

Attack response: Blind ROP

If server restarts on a crash, but does not re-randomize: 1.Read the stack to leak canaries and a return address 2.Find gadgets (at run-time) to effect call to write

SLIDE 71

Blind ROP

Defense: Randomizing the location of the code

(by compiling for position independence) on a 64- bit machine makes attacks very difficult

Recent, published attacks are often for 32-bit

versions of executables

Attack response: Blind ROP

If server restarts on a crash, but does not re-randomize: 1.Read the stack to leak canaries and a return address 2.Find gadgets (at run-time) to effect call to write 3.Dump binary to find gadgets for shellcode

http://www.scs.stanford.edu/brop/

SLIDE 72

Defeat!

The blind ROP team was able to completely

automatically, only through remote interactions, develop a remote code exploit for nginx, a popular web server

SLIDE 73

Defeat!

The blind ROP team was able to completely

automatically, only through remote interactions, develop a remote code exploit for nginx, a popular web server

The exploit was carried out on a 64-bit executable

with full stack canaries and randomization

SLIDE 74

Defeat!

The blind ROP team was able to completely

automatically, only through remote interactions, develop a remote code exploit for nginx, a popular web server

The exploit was carried out on a 64-bit executable

with full stack canaries and randomization

Conclusion: give an inch, and they take a mile?

SLIDE 75

Defeat!

The blind ROP team was able to completely

automatically, only through remote interactions, develop a remote code exploit for nginx, a popular web server

The exploit was carried out on a 64-bit executable

with full stack canaries and randomization

Conclusion: give an inch, and they take a mile?
Put another way: Memory safety is really useful!

SLIDE 76

void safe() { char buf[80]; fgets(buf, 80, stdin); } void safer() { char buf[80]; fgets(buf, sizeof(buf), stdin); }

SLIDE 77

void safe() { char buf[80]; fgets(buf, 80, stdin); } void safer() { char buf[80]; fgets(buf, sizeof(buf), stdin); } void vulnerable() { char buf[80]; if(fgets(buf, sizeof(buf), stdin)==NULL) return; printf(buf); }

SLIDE 78

void safe() { char buf[80]; fgets(buf, 80, stdin); } void safer() { char buf[80]; fgets(buf, sizeof(buf), stdin); } void vulnerable() { char buf[80]; if(fgets(buf, sizeof(buf), stdin)==NULL) return; printf(buf); }

SLIDE 79

Format string vulnerabilities

0xffffffff 0x00000000

&i 10 %eip %ebp &fmt …

printf takes variable number of arguments
printf pays no mind to where the stack frame “ends”
It presumes that you called it with (at least) as many arguments as

specified in the format string

SLIDE 86

caller’s  stack frame printf’s stack frame

printf format strings

int i = 10; printf(“%d %p\n”, i, &i);

0xffffffff 0x00000000

&i 10 %eip %ebp &fmt …

printf takes variable number of arguments
printf pays no mind to where the stack frame “ends”
It presumes that you called it with (at least) as many arguments as

specified in the format string

SLIDE 87

caller’s  stack frame printf’s stack frame

printf format strings

int i = 10; printf(“%d %p\n”, i, &i);

0xffffffff 0x00000000

&i 10 %eip %ebp &fmt …

printf takes variable number of arguments
printf pays no mind to where the stack frame “ends”
It presumes that you called it with (at least) as many arguments as

specified in the format string

SLIDE 88

caller’s  stack frame printf’s stack frame

printf format strings

int i = 10; printf(“%d %p\n”, i, &i);

0xffffffff 0x00000000

&i 10 %eip %ebp &fmt …

printf takes variable number of arguments
printf pays no mind to where the stack frame “ends”
It presumes that you called it with (at least) as many arguments as

specified in the format string

SLIDE 89

void vulnerable() { char buf[80]; if(fgets(buf, sizeof(buf), stdin)==NULL) return; printf(buf); }

SLIDE 90

void vulnerable() { char buf[80]; if(fgets(buf, sizeof(buf), stdin)==NULL) return; printf(buf); }

“%d %x"

SLIDE 91

void vulnerable() { char buf[80]; if(fgets(buf, sizeof(buf), stdin)==NULL) return; printf(buf); }

caller’s  stack frame 0xffffffff 0x00000000

%eip %ebp &fmt …

“%d %x"

SLIDE 92

void vulnerable() { char buf[80]; if(fgets(buf, sizeof(buf), stdin)==NULL) return; printf(buf); }

caller’s  stack frame 0xffffffff 0x00000000

%eip %ebp &fmt …

“%d %x"

SLIDE 93

void vulnerable() { char buf[80]; if(fgets(buf, sizeof(buf), stdin)==NULL) return; printf(buf); }

caller’s  stack frame 0xffffffff 0x00000000

%eip %ebp &fmt …

“%d %x"

SLIDE 94

Format string vulnerabilities

SLIDE 95

Format string vulnerabilities

printf(“100% dml”);

SLIDE 96

Format string vulnerabilities

printf(“100% dml”);
Prints stack entry 4 byes above saved %eip

SLIDE 97

Format string vulnerabilities

printf(“100% dml”);
Prints stack entry 4 byes above saved %eip
printf(“%s”);

SLIDE 98

Format string vulnerabilities

printf(“100% dml”);
Prints stack entry 4 byes above saved %eip
printf(“%s”);
Prints bytes pointed to by that stack entry

SLIDE 99

Format string vulnerabilities

printf(“100% dml”);
Prints stack entry 4 byes above saved %eip
printf(“%s”);
Prints bytes pointed to by that stack entry
printf(“%d %d %d %d …”);

SLIDE 100

Format string vulnerabilities

printf(“100% dml”);
Prints stack entry 4 byes above saved %eip
printf(“%s”);
Prints bytes pointed to by that stack entry
printf(“%d %d %d %d …”);
Prints a series of stack entries as integers

SLIDE 101

Format string vulnerabilities

printf(“100% dml”);
Prints stack entry 4 byes above saved %eip
printf(“%s”);
Prints bytes pointed to by that stack entry
printf(“%d %d %d %d …”);
Prints a series of stack entries as integers
printf(“%08x %08x %08x %08x …”);

SLIDE 102

Format string vulnerabilities

printf(“100% dml”);
Prints stack entry 4 byes above saved %eip
printf(“%s”);
Prints bytes pointed to by that stack entry
printf(“%d %d %d %d …”);
Prints a series of stack entries as integers
printf(“%08x %08x %08x %08x …”);
Same, but nicely formatted hex

SLIDE 103

Format string vulnerabilities

printf(“100% dml”);
Prints stack entry 4 byes above saved %eip
printf(“%s”);
Prints bytes pointed to by that stack entry
printf(“%d %d %d %d …”);
Prints a series of stack entries as integers
printf(“%08x %08x %08x %08x …”);
Same, but nicely formatted hex
printf(“100% no way!”)

SLIDE 104

Format string vulnerabilities

printf(“100% dml”);
Prints stack entry 4 byes above saved %eip
printf(“%s”);
Prints bytes pointed to by that stack entry
printf(“%d %d %d %d …”);
Prints a series of stack entries as integers
printf(“%08x %08x %08x %08x …”);
Same, but nicely formatted hex
printf(“100% no way!”)
WRITES the number 3 to address pointed to by stack entry

SLIDE 105

Format string prevalence

0.125 0.25 0.375 0.5 2002 2004 2006 2008 2010 2012 2014 2016

% of vulnerabilities that involve format string bugs

http://web.nvd.nist.gov/view/vuln/statistics

SLIDE 106

What’s wrong with this code?

#define BUF_SIZE 16 char buf[BUF_SIZE]; void vulnerable() { int len = read_int_from_network(); char *p = read_string_from_network(); if(len > BUF_SIZE) { printf(“Too large\n”); return; } memcpy(buf, p, len); }

SLIDE 107

What’s wrong with this code?

#define BUF_SIZE 16 char buf[BUF_SIZE]; void vulnerable() { int len = read_int_from_network(); char *p = read_string_from_network(); if(len > BUF_SIZE) { printf(“Too large\n”); return; } memcpy(buf, p, len); } void *memcpy(void *dest, const void *src, size_t n);

SLIDE 108

What’s wrong with this code?

#define BUF_SIZE 16 char buf[BUF_SIZE]; void vulnerable() { int len = read_int_from_network(); char *p = read_string_from_network(); if(len > BUF_SIZE) { printf(“Too large\n”); return; } memcpy(buf, p, len); } void *memcpy(void *dest, const void *src, size_t n); typedef unsigned int size_t;

SLIDE 109

What’s wrong with this code?

#define BUF_SIZE 16 char buf[BUF_SIZE]; void vulnerable() { int len = read_int_from_network(); char *p = read_string_from_network(); if(len > BUF_SIZE) { printf(“Too large\n”); return; } memcpy(buf, p, len); } void *memcpy(void *dest, const void *src, size_t n); typedef unsigned int size_t;

Negative

SLIDE 110

What’s wrong with this code?

#define BUF_SIZE 16 char buf[BUF_SIZE]; void vulnerable() { int len = read_int_from_network(); char *p = read_string_from_network(); if(len > BUF_SIZE) { printf(“Too large\n”); return; } memcpy(buf, p, len); } void *memcpy(void *dest, const void *src, size_t n); typedef unsigned int size_t;

Ok Negative

SLIDE 111

What’s wrong with this code?

#define BUF_SIZE 16 char buf[BUF_SIZE]; void vulnerable() { int len = read_int_from_network(); char *p = read_string_from_network(); if(len > BUF_SIZE) { printf(“Too large\n”); return; } memcpy(buf, p, len); } void *memcpy(void *dest, const void *src, size_t n); typedef unsigned int size_t;

Ok Negative Implicit cast to unsigned

SLIDE 112

Integer overflow vulnerabilities

SLIDE 113

What’s wrong with this code?

void vulnerable() { size_t len; char *buf; len = read_int_from_network(); buf = malloc(len + 5); read(fd, buf, len); ... }

SLIDE 114

What’s wrong with this code?

void vulnerable() { size_t len; char *buf; len = read_int_from_network(); buf = malloc(len + 5); read(fd, buf, len); ... }

HUGE

SLIDE 115

What’s wrong with this code?

void vulnerable() { size_t len; char *buf; len = read_int_from_network(); buf = malloc(len + 5); read(fd, buf, len); ... }

HUGE Wrap-around

SLIDE 116

What’s wrong with this code?

void vulnerable() { size_t len; char *buf; len = read_int_from_network(); buf = malloc(len + 5); read(fd, buf, len); ... }

HUGE Wrap-around Takeaway: You have to know the semantics

f your programming language to avoid these errors

SLIDE 117

Integer overflow prevalence

0.5 1 1.5 2 2.5 2002 2004 2006 2008 2010 2012 2014 2016

% of vulnerabilities that  involve integer overflows

http://web.nvd.nist.gov/view/vuln/statistics