Chapter 7 - Format String Attacks

Abstract

Format string vulnerabilities occur when programmers pass externally supplied data to a printf function (or similar) as, or as part of, the format string argument. Printf functions, and bugs due to the misuse of them, have been around for years. However, no one ever conceived of exploiting them to force the execution of shellcode until the year 2000. In addition to format string bugs, new techniques have emerged such as overwriting malloc structures, relying on free() to overwrite pointers, and using signed integer index errors. Format bugs appear because of the interplay of C functions with variable numbers of arguments and the power of format specification tokens, which sometimes allow writing values on the stack. Techniques for exploiting format string bugs require many calculations, which are usually automated with scripts. When a format string in printf (or any similar function) is controlled by an attacker, under certain conditions the memory and read arbitrary data can be modified simply by supplying a specially crafted format string. To prevent format string bugs employing user-controlled variables as the format string argument in all relevant functions should be avoided—or even better, a constant format string should be used wherever possible. Searching for format string bugs is easy compared to the cases of stack or heap overflows, both in source code and in existing binaries.