On Fri, May 19, 2017 at 11:32 PM, Kees Cook <keesc...@chromium.org> wrote:
> On Fri, May 19, 2017 at 2:26 PM, <r...@redhat.com> wrote:
>> Zero out the first byte of the stack canary value on 64 bit systems,
>> in order to prevent unterminated C string overflows from being able
>> to successfully overwrite the canary, even if an attacker somehow
>> guessed or obtained the canary value.
>
> This also stops string functions from being able to read the canary.
>
> It might also be worth mentioning that the reduction in entropy for
> 64-bit to gain this corner-case protection is worth it, but on 32-bit,
> it is not. (Which is especially true given that the 64-bit canary was
> only 32-bits in some cases until recently.)
+1
It took me a while to deduce that myself, when I started wondering why
this was not done for 32-bit.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- ge...@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
