Billions of devices imperiled by new clickless Bluetooth attack (ars technica) [LWN.net]

Billions of devices imperiled by new clickless Bluetooth attack (ars technica)

Posted Sep 14, 2017 4:21 UTC (Thu) by thestinger (guest, #91827)
In reply to: Billions of devices imperiled by new clickless Bluetooth attack (ars technica) by eru
Parent article: Billions of devices imperiled by new clickless Bluetooth attack (ars technica)

CONFIG_CC_STACKPROTECTOR / CONFIG_CC_STACKPROTECTOR_STRONG are the only form of stack canaries supported by the mainline Linux kernel, i.e. the SSP implementation in GCC and Clang. It has per-thread random values for some environments, but most non-x86 environments are stuck with a global random value.

There are better implementations of canaries and other more modern mitigations but they aren't what was being discussion. I wasn't responding to a comment about SafeStack, CFI, XOR canaries, finer-grained canaries or other mitigations. It was claimed that CONFIG_CC_STACKPROTECTOR (SSP) makes this unrealistic to exploit, which I think is far from true, and the proof of concept was done against a system with a kernel compiled with -fstack-protector-strong.

to post comments

Billions of devices imperiled by new clickless Bluetooth attack (ars technica)

Posted Sep 14, 2017 4:25 UTC (Thu) by thestinger (guest, #91827) [Link]

s/being discussion/being discussed/

If and when they release their PoC exploit(s), we'll see how they bypassed stack canaries. Claiming that it makes it infeasible to exploit is a claim that they're lying about having working exploits for those systems... and I think that's unfair at this point. There's no reason to think that they couldn't find an information leak either letting them read the value from the global (would work fine with a finer-grained implementation too) or from the stack.