How does arbitrary execution work?
Arbitrary code execution is commonly achieved through control over the instruction pointer (such as a jump or a branch) of a running process. The instruction pointer points to the next instruction in the process that will be executed. The injected code will then automatically get executed.
Why are arbitrary remote code execution attacks so popular?
These attacks are typically written into an automated script. Remote arbitrary code execution is most often aimed at giving a remote user administrative access on a vulnerable system. Once identified, the attacker executes the script against the program with hopes of gaining local administrative access on the host.
What can you do with remote code execution?
Remote code execution (RCE) refers to the ability of a cyberattacker to access and make changes to a computer owned by another, without authority and regardless of where the computer is geographically located. RCE allows an attacker to take over a computer or a server by running arbitrary malicious software (malware).
What can cause buffer overflow?
A buffer overflow occurs when data written to a buffer also corrupts data values in memory addresses adjacent to the destination buffer due to insufficient bounds checking. This can occur when copying data from one buffer to another without first checking that the data fits within the destination buffer.
What happens when there is a buffer overflow?
Even when arbitrary code execution is not possible, a buffer overflow often results in a crash, leading to a denial of service (DoS) condition that affects the availability of the application and the processes it handles. This is particularly bad on server deployments where continuous availability is needed and expected.
How can buffer overflows lead to privilege escalation?
In certain cases, attackers can also use buffer overflows to overwrite critical settings in an application’s memory, for example a flag indicating whether the user is an administrator or not. This can lead to privilege escalation in the context of the application and potentially the system itself.
What can out of bound reads be used for?
Out-of-bound reads can also be used to obtain information that can help attackers exploit other vulnerabilities. For example, they can be used to disclose memory addresses that are protected by kernel anti-exploitation technologies such as address space layout randomization (ASLR).