Re: OS stopping stack buffer overflow exploits

From: Matthew Dharm (
Date: Sat Jun 03 2000 - 21:48:17 EST

On Sat, Jun 03, 2000 at 09:06:46PM -0500, Robert Redelmeier wrote:
> 2) On syscall entry, the kernel could check the page tables
> to be sure that the return address is from code pages (read-only),
> and not from data pages (read-write). The kernel would log and
> terminate any such process. Kill some nasty bugs this way too.
> This assumes an exploit can do limited damage without syscalls.

Hrm... this could cause some problems for applications which use
self-modifying code (i.e. trampoline handlers, etc.)


Matthew Dharm                              Home: 
Senior Engineer, QCP Inc.                            Work:

We can customize our colonels. -- Tux User Friendly, 12/1/1998

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to Please read the FAQ at

This archive was generated by hypermail 2b29 : Wed Jun 07 2000 - 21:00:18 EST