283709 - [execshield] libxpcom.so has executable stack on ia64 and ppc

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[Christopher Aillon (sabbatical, not receiving bugmail)]

> readelf -Wl libxpcom.so | grep GNU_STACK
  GNU_STACK          0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x4

The stack should be RW, not RWE.  If someone can inject code into the stack
(using a buffer overflow, etc), it could be executed.

Comment 1

[Christopher Aillon (sabbatical, not receiving bugmail)]

Attachment: Patch

Patch.	Magic 8ball says shaver/brendan.

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 175621 [details] [diff] [review]
Patch

sr=me assuming nothing needs to trampoline off stack space code in our world.

/be

Comment 3

[Daniel Veditz [:dveditz]]

Why is this confidential? This adds protection but revealing the bug doesn't
make anyone less safe.

Comment 4

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 175621 [details] [diff] [review]
Patch

sr=shaver

Comment 5

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 175621 [details] [diff] [review]
Patch

Apparently, I screwed up the flags here.  Adding my r, readding brendan's sr.

Comment 6

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 175621 [details] [diff] [review]
Patch

Looking for approval for this low-risk patch for a few ports to fix a potential
for trouble if someone can get code onto the stack.  I have done respins for
this fix, so it would be great to get it on to the branch.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 175621 [details] [diff] [review]
Patch

None of these files are compiled in any mozilla.org builds, so approving this
is fine with me, and some Linux distros do care.

Comment 8

[Christopher Aillon (sabbatical, not receiving bugmail)]

Fixed on trunk and branches.

Comment 9

[Daniel Veditz [:dveditz]]

Is there any need for this to be security confidential still?

Comment 10

[Christopher Aillon (sabbatical, not receiving bugmail)]

Nope, removing flag