Nowadays with protections like W^X , is it still possible to successfully exploit buffer overflows with for example NOP Slide ?

  • I think this question belongs on the infosec SE rather than here. Probably it will also be a duplicate over there. I've flagged this question so someone can do the migration. – rlf Jun 10 '20 at 15:57

The exploitability of a buffer overflow is very variable based on the surrounding code. For example, are other mitigation techniques in place such as stack canaries. However if you are only considering DEP/W^X then yes, it can still often be possible to exploit them.

How you would go about exploiting it greatly depend on the type of buffer overflow. Judging from you mentioning using a NOP slide, I assume you're talking about a simple stack based buffer overflow. In this case, you can use techniques such as Return Oriented Programming (ROP) or Jump Oriented Programming (JOP). These techniques reuse code that exists in sections of memory that are already marked as executable. Therefore, you do not require memory that is marked both as executable and writeable.

One tecnique for mitigating these code reuse attacks is Control Flow Integrity (CFI) checking. This mitigation tries to only allow the code to flow through known "good" paths. This has begun to gain more mainstream support in recent years with e.g. compiler support from clang/llvm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.