Azeria

Impact: Basically, any AArch64 software compiled with GCC & the stack protection feature (flag -fstack-protector) that is vulnerable to buffer overflows via dynamically-sized variables can be exploited without bypassing this exploit mitigation. If you want to reproduce this bug with the PoC from the advisory on your x86/64 machine, here’s how:

GCC’s stack protection feature (aka canary) is an exploit mitigation to prevent buffer overflows from overwriting saved registers on the stack to take control over the program flow. It makes exploitation much harder. You often need an additional bug to bypass this mitigation.

The issue: When targeting AArch64, this mitigation didn’t protect saved registers from overflows in C99-style dynamically allocated local variables and alloca() objects.

CVE-2023-4039: “GCC's -fstack-protector fails to guard dynamic stack allocations on ARM64” On AArch64 targets, GCC's stack smashing protection does not detect or defend against overflows of dynamically-sized local variables. Affecting all versions of GCC for AArch64 targets.

Time for an Arm-twist! CVE-2023-4039

Tom Hebb (Meta red team) and I discovered an 0day in GCC (for AArch64 targets) during my Arm exploitation training.

It renders stack canaries against overflows of dynamically-sized variables useless.

https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64

I’m doing two book signing sessions in collaboration with Patrick Wardle at Black Hat and Defcon this year! 🥳

Black Hat:
Thursday 8/10 - 12:15pm:
BH Bookstore - Breakers Registration 2

Defcon:
Saturday 8/12 - 11:00am
Caesar’s - Alliance Ballroom - Room 321

So where is everyone nowadays? Twitter? Mastodon? BlueSky? Threads?

My own book copy arrived today!

Words can’t express how it feels like to hold 3 years of work in your hands…

@saper@mastodon.social it’s an introduction to different Arm environments you can use for Research and debugging. E.g. cloud, boards, emulation.

@Lee_Holmes@infosec.exchange Awh thanks Lee :)

My new book "Arm Assembly Internals & Reverse Engineering" is up for pre-order!

Save the date for the official launch: May 9th.

Can't wait for you to dive into the world of Arm Assembly!

Check out the official book page for more info:
https://arm-assembly.com

@securingdev@infosec.exchange @0xamit@infosec.exchange @malwaretech@infosec.exchange for RE, I usually use a mix of MacOS and Linux. My IDA Pro version is MacOS based so that’s what I have to use for disassembling. But depending on what binary you’re reversing, if it’s Unix based, you can use something like Debian to debug it (or remote debug it in my case)

@securingdev@infosec.exchange @0xamit@infosec.exchange @malwaretech@infosec.exchange tbf I mainly use Debian, especially for Arm distros. I haven’t use Kali since I was a junior Pentester. I would recommend a clean system, then carefully install what you really need as you go. Especially for exploit dev, you’d need debuggers or GDB wrappers (e.g. GEF or Peda) and other tools you don’t necessarily find on Kali. For malware analysis, it depends what type of malware you’re analyzing

@malwaretech@mastodon.social \o/