Date: Fri, 11 Feb 2005 10:45:16 -0500 From: Coleman Kane <zombyfork@gmail.com> To: Astrodog <astrodog@gmail.com> Cc: freebsd-amd64@freebsd.org Subject: Re: FreeBSD x86 vs x86-64 Questions about Security Message-ID: <346a802205021107456c40fbd2@mail.gmail.com> In-Reply-To: <2fd864e050211065931e2f425@mail.gmail.com> References: <420C649D.8070502@oranged.to> <346a8022050211063022cb57e2@mail.gmail.com> <2fd864e050211065931e2f425@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
I believe there is still a large overlap of opcodes in both architectures. For instance, NOP is still 0x90. In addition I believe the default operand size (i.e.: no REX prefix) in PM64 is 32-bit, just like PM32 (protected mode 64 vs. 32 bit). This would lead me to believe that many stack-smashing exploits may still apply. Now, other certain instructions, such as Jcc (0x7*) and JMPs (0xe9,a,b) default to 64-bit offsets. Now comes the fun part: Since the amd64 and ia32 are both little-endian, an exploit which makes use of these default-64bit instructions would only need their operands to be sign extended: IA-32 [OP] [DEST 0..7] [DEST 8..15] [DEST 16..23] [DEST 24..31] amd64: [OP] [DEST 0..7] [DEST 8..15] [DEST 16..23] [DEST 24..31] ... [DEST 56..63] So if OP is a CALL, or JMP or similar, you could use the same code, provided the destination address is the same. It will execute. Now if it succeeds, that is another matter which I have not looked into yet. I think the IA32 uses INT 0x80, while amd64 uses SYSCALL to handle syscalls. There are probably other significant differences as well. I would think that a sufficiently creative persone could come up with an exploit which works on both systems. On Fri, 11 Feb 2005 06:59:38 -0800, Astrodog <astrodog@gmail.com> wrote: > > > I think that FreeBSD-AMD64 will not be effected directly, in that > shellcode written for i386 won't work anymore. However, the security > flaw would still exist, so there's still a threat, its just one > script-kiddies won't catch. The i386 compat layer won't allow > vunerable i386 shellcode to run from within an AMD64 application, > since the ELF detection that makes COMPAT_IA32 work wouldn't kick in. > i386-compiled applications could still, theoretically, be exploited > with i386 shellcode though. However, AMD64 applications would not > execute the shellcode, or, rather, wouldn't actually be able to, > they'd just crash. > > --- Harrison Grundy > _______________________________________________ > freebsd-amd64@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-amd64 > To unsubscribe, send any mail to "freebsd-amd64-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?346a802205021107456c40fbd2>