1
$\begingroup$

I'm currently reading this paper: Code injection attacks on Harvard-architecture devices (ACM) (pdf)

I understand the basics of what the attack is trying to do, but one thing really bothers me. If Harvard Architecture is supposed to have a strict separation of code and data, how is the initial buffer overflow allowing the attacker to rewrite return addresses on the stack? Since the architecture only allows data to be read into instruction memory via the SPM instruction--one that is specially reserved--I just don't get where the ability to rewrite the ret pointers is coming from. I feel like I'm missing something obvious.

$\endgroup$

migrated from stackoverflow.com Dec 14 '13 at 15:17

This question came from our site for professional and enthusiast programmers.

3
$\begingroup$

I believe the architecture you're interested in - the AVR - is actually a modified Harvard architecture, whereby instruction memory can be accessed by instructions as if it were data. (I haven't used the AVR in a while, so I don't recall if you can execute instructions out of RAM.)

The ARM Cortex M processors (perhaps others) are similar. There aren't too many pure Harvard architectures in new designs these days.

By the way (since you tagged your question with "atmega"), there is a good paper by Francillon and Castelluccia (PDF from ACM Proceedings) regarding code injection attacks on (modified) Harvard architecture devices, including the AVR.

$\endgroup$
  • 1
    $\begingroup$ Actually that was the paper I linked to in the original question. I've studied that paper forwards and backwards, and from what I understand about that architecture, the initial step of overwriting the RET pointer shouldn't be possible. Hence my question here. $\endgroup$ – avgvstvs Dec 1 '13 at 17:51
  • 2
    $\begingroup$ @avgvstvs The return stack is data and is therefore susceptible to corruption. It is only the code that is protected. $\endgroup$ – Raymond Chen Dec 3 '13 at 14:44
  • $\begingroup$ I'm taking a class on reversing right now, and while I haven't had the chance to get my hands on the atmega, the stack pointer is on a register and I wasn't thinking about registers as data. $\endgroup$ – avgvstvs Feb 14 '14 at 17:39
1
$\begingroup$

Yes, the program can write to the return address on the stack. The CALL instruction has to be able to do it, and other instructions can too. The stack is just part of the data segment, so any instruction that operates on data potentially has the ability to overwrite the return address. There's nothing in the architecture that prevents it.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.