基于段长限制的缓冲区溢出保护

Buffer Overflow Protection Based on Segment Limitation

为防范缓冲区溢出攻击,在Intel32位CPU及Windows系统下实现了不可执行堆栈。设计了一个内核驱动程序,将应用程序的堆栈移动到代码区的上部,并修改代码段的限长将堆栈区排除在代码段之外。堆栈中的攻击代码被执行时,CPU就会触发一个保护异常,攻击代码不能继续执行。这种方法能够防范各种已知及未知的堆栈溢出攻击,性能开销低于基于页的防护方式。

A non-executable stack approach is proposed and evaluated to defense against stack-based buffer overflow attacks under Windows and Intel 32-bit CPUs. A kernel device driver is designed to relocate the application＇s user-mode stack to the higher address and to modify the effective limit in the code segment descriptor, so the relocated stack is excluded from the code segment. Once any malicious code that attempts to execute in the stack, a general-protection exception is triggered, then the malicious code will be terminated, It is highly effective in preventing both known and yet unknown stack smashing attacks, and its performance overhead is lower than the page-based non-executable stack approach.