Stack Frame Canary

Properties

name

Stack Frame Canary

definition

Stack canaries, named for their analogy to a canary in a coal mine, are used to detect a stack buffer overflow before execution of malicious code can occur. This method works by placing a small integer, the value of which is randomly chosen at program start, in memory just before the stack return pointer. Most buffer overflows overwrite memory from lower to higher memory addresses, so in order to overwrite the return pointer (and thus take control of the process) the canary value must also be overwritten. This value is checked to make sure it has not changed before a routine uses the return pointer on the stack. This technique can greatly increase the difficulty of exploiting a stack buffer overflow because it forces the attacker to gain control of the instruction pointer by some non-traditional means such as corrupting other important variables on the stack.

synonyms

Stack Canary

defined by

http://dbpedia.org/resource/Stack_buffer_overflow#Stack_canaries

Neighbors

        graph LR;

    d3f:StackFrame["Stack Frame"] --> | may-contain | d3f:StackFrameCanary["Stack Frame Canary"];

            class d3f:StackFrame inbound_node;
            style d3f:StackFrame fill:#fff4dd;

            class d3f:StackFrameCanary RootArtifactNode;
            style d3f:StackFrameCanary fill:#fff4dd;

            click d3f:StackFrame href "/dao/artifact/d3f:StackFrame";
            click d3f:StackFrameCanary href "/dao/artifact/d3f:StackFrameCanary";