Stacks are executable even with `noexecstack`

Question

I'm trying to protect my application against buffer overflow exploits. Among other things, I'm using non-executable stacks and link my binaries with the noexecstack flag (by passing -Wl,-z,noexecstack to gcc).

Everything seems fine - readelf confirms that PT_GNU_STACK specifies correct permissions:

$ readelf -l target | grep -A1 GNU_STACK
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RW     10

So does execstack:

$ execstack -q target
- target

There's only one problem. All my stacks are actually executable:

root@170ubuntu16p04-64smp-1:~# cat /proc/12878/task/*/maps | grep stack
7ffcac654000-7ffcac675000 rwxp 00000000 00:00 0                          [stack]
7fe540e66000-7fe541666000 rwxp 00000000 00:00 0                          [stack]
7fe540665000-7fe540e65000 rwxp 00000000 00:00 0                          [stack]
7fe53b800000-7fe53c000000 rwxp 00000000 00:00 0                          [stack]

I've trapped allocate_stack calls and examined protection flags. In theory, they should be initialized according to PT_GNU_STACK. But in my case, it seems like PT_GNU_STACK was ignored and _dl_stack_flags was initialized with default permissions.

Does anyone know what could have caused this? Everything seems correct, but stacks are still executable.

I'm using gcc 4.8.3 / glibc 2.11.

Answer 1

what could have caused this?

In addition to the main executable's PT_GNU_STACK having correct permissions, you also need to have PT_GNU_STACK with correct permissions in every directly-linked shared library.

If any one of these libraries does not have PT_GNU_STACK at all, or has one with executable permissions, it will "poison" all of your stacks with executable permission.

So run

for j in $(ldd target | grep -o '=> .* ' | sed -e 's/=> //' -e '/^ *$/d' ); do
  out=$(readelf -Wl $j | grep STACK)
  [[ -z "$out" ]] &&  echo "missing GNU_STACK in $j"
  echo $out | grep -q RWE && echo "executable GNU_STACK in $j"
done

and you will likely see at least one library with missing or executable stack.

P.S. I see that Olaf has already (partially) suggested this.