Hello, welcome to the Tuesday, June 20th, 2017 edition of the Sands and its Storm Center's

Stormcast. My name is Johannes Ulrich, and the time I'm recording from Minneapolis, Minnesota.

Qualis today released details regarding privilege escalation vulnerability that Qualis calls StackClash.

Now, typically, per which escalation vulnerabilities don't excite me that terribly much.

What's interesting here is that a number of different Unix-based operating systems are affected.

So it's not just Linux.

It's also OpenBSD, NetBSD, FreeBSD, and Solaris as far as it's running on an I-386 or AMD-64 architecture.

Now interestingly, the fundamental problem isn't actually new. It was originally

found in 2005, and Qualis also refers to that particular discovery. And what's happening here

is that as software needs more space on the stack, the stack will sort of automatically increase in size,

but it may eventually clash or override existing heap memory,

and that leads then to approach escalation

where a user's stack grows over heap from another process,

and as a result, arbitrary code could be executed. Now it is an old vulnerability back from 2005 and actually then in 2010 other variations of it were discovered.

Why is this still in news?

The interesting thing is that Qualis came up with ways to bypass the security

mechanism that was implemented originally. Essentially, what was implemented to prevent this from

happening is what's called a Stackguard page. Stackguard is a memory area just below the stack that will essentially be used as

a sensor to detect if the stack is growing. So if the stack is expanded into this memory,

that's a sign that the stack needed more memory and the operating system can deal with it.

What Qualis found out is that if you trigger an expansion of the stack that exceeds the size of that stack guard page, then the stack is extended to a memory page that's no longer covered by this stack guard and that way it goes undetected and you may again run into

heap memory and overwrite it and you're back to a privilege escalation.

...