0

I'm running Ubuntu 18.04 and a simple program such as:

#include <stdio.h>

int main(int ac, char *av[ac+1], char **env) {
    char arr[8];

    printf("0x%x\n", av);
    scanf("%s", arr);
    return 0;
}

terminates, when attacked with a buffer overrun, with message:

*** stack smashing detected ***: <unknown> terminated

In previous versions of Ubuntu (or Linux? I don't know what changed), it would print out something like:

*** stack smashing detected ***: ./a.out terminated

Can I restore it? What has changed?

  • If you have the old version of Ubuntu still running, executing an strace on the executables and comparing the stderr may give insight – Chuck Horowitz Jul 16 at 20:44
  • 1
    It might be that they've decided to not have any variables for the print line, since those variables may be suspect as well. – Aaron D. Marasco Jul 16 at 21:37
  • @AaronD.Marasco I don't understand your point – norake Jul 16 at 23:16
  • @norake since argv[0] (the program name) lives itself on the stack, the stack smashing detector trying to access the corrupted stack may itself turn into a liability. See the comments from the source code in my answer, and the commit linked from it. – mosvy Jul 17 at 1:40
  • Yeah - what @norake said. If your stack is smashed, you can't trust it so want to use as little as possible. – Aaron D. Marasco Jul 18 at 22:43
2

I'm not running ubuntu, but I don't think that's possible in newer versions of glibc. See this commit.

Short of writing your own stack smashing detector, of course.

You can have a look at the source of the function printing that message:

void
__attribute__ ((noreturn))
__fortify_fail_abort (_Bool need_backtrace, const char *msg)
{
  /* The loop is added only to keep gcc happy.  Don't pass down
     __libc_argv[0] if we aren't doing backtrace since __libc_argv[0]
     may point to the corrupted stack.  */
  while (1)
    __libc_message (need_backtrace ? (do_abort | do_backtrace) : do_abort,
            "*** %s ***: %s terminated\n",
            msg,
            (need_backtrace && __libc_argv[0] != NULL
             ? __libc_argv[0] : "<unknown>"));
}

This function will be called with need_backtrace = False from the __stack_chk_fail, itself called from the stack protector code compiled into the binary.

  • This is what I wanted. I remember security exploits against the name of the binary being printed out, do you have any link to them? I could not find any anymore. – norake Jul 17 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.