Return-to-libc attack

From Wikipedia, the free encyclopedia

A return-to-libc attack is a computer security attack usually starting with a buffer overflow, in which the return address on the stack is replaced by the address of another function, and the correct portion of the stack is overwritten to provide arguments to this function. This allows attackers to call pre-existing functions without the need to inject malicious code into a program.

The shared library called "libc" provides the C runtime on UNIX style systems. Although the attacker could make the code return anywhere, libc is the most likely target, as it is always linked to the program, and it provides useful calls for an attacker (such as the system() call to execute an arbitrary program, which needs only one argument). This is why the exploit is called "return-to-libc" even when the return address may be in something named completely different.

[edit] Protection from return-to-libc attacks

A non-executable stack can prevent some buffer overflows, but not a return-to-libc attack: only existing, executable code is used. On the other hand, these attacks can only call pre-existing functions. Stack-smashing protection can prevent or obstruct exploitation, as it can detect the corruption of the stack. Address space layout randomization makes this type of attack extremely difficult, as the locations of all functions in memory are random.