M6: Software security - exploits and privilege escalation - C6

Question 1

What is a race condition in the context of file systems?

M6: Software security - exploits and privilege escalation - C6

Answer 1

It’s when a file’s state changes between the time it’s checked and the time it’s used, potentially leading to security issues.

Question 2

What is a TOCTOU race?

M6: Software security - exploits and privilege escalation - C6

Answer 2

Time-of-check to time-of-use race, where changes between checking a condition and using it can be exploited.

Question 3

How can race conditions be mitigated?

M6: Software security - exploits and privilege escalation - C6

Answer 3

By using atomic operations or ensuring the condition and action are inseparable.

Question 4

What is an integer overflow?

M6: Software security - exploits and privilege escalation - C6

Answer 4

When a calculation exceeds the maximum value a data type can hold, causing it to wrap around.

Question 5

What is an integer underflow?

M6: Software security - exploits and privilege escalation - C6

Answer 5

When a calculation goes below the minimum value a data type can hold, causing it to wrap around.

Question 6

Why are integer-based vulnerabilities common in C?

M6: Software security - exploits and privilege escalation - C6

Answer 6

Because C allows operations between different data types and has weak type safety.

Question 7

What is a buffer overflow?

M6: Software security - exploits and privilege escalation - C6

Answer 7

When more data is written to a buffer than it can hold, overwriting adjacent memory.

Question 8

What is a stack-based buffer overflow?

M6: Software security - exploits and privilege escalation - C6

Answer 8

An overflow that occurs in the stack memory, often used for function calls and local variables.

Question 9

How can buffer overflows be exploited?

M6: Software security - exploits and privilege escalation - C6

Answer 9

By overwriting memory to execute malicious code or crash the system.

Question 10

What is heap spraying?

M6: Software security - exploits and privilege escalation - C6

Answer 10

A technique where an attacker fills the heap with malicious code to increase the chances of successful exploitation.

Question 11

What is a return-to-libc exploit?

M6: Software security - exploits and privilege escalation - C6

Answer 11

An attack that redirects execution to existing library functions instead of injecting new code.

Question 12

What is privilege escalation?

M6: Software security - exploits and privilege escalation - C6

Answer 12

Gaining higher access rights than initially granted, often from a regular user to an administrator.

Question 13

How do attackers use TOCTOU races for privilege escalation?

M6: Software security - exploits and privilege escalation - C6

Answer 13

By changing file bindings between checks and actions to gain unauthorized access.

Question 14

What is the role of the stack pointer (SP) in function calls?

M6: Software security - exploits and privilege escalation - C6

Answer 14

It tracks the top of the stack, adjusting as functions push and pop data.

Question 15

What is the frame pointer (FP) used for?

M6: Software security - exploits and privilege escalation - C6

Answer 15

It helps manage stack frames, pointing to the base of the current function’s stack frame.

Question 16

What is a setuid program?

M6: Software security - exploits and privilege escalation - C6

Answer 16

A Unix program that runs with the privileges of the file’s owner, not the user who runs it.

Question 17

Why is using the access() syscall for permission checks discouraged?

M6: Software security - exploits and privilege escalation - C6

Answer 17

Because it can be exploited in TOCTOU races, leading to unauthorized actions.

Question 18

What is a symbolic link (symlink)?

M6: Software security - exploits and privilege escalation - C6

Answer 18

A file that points to another file or directory, used for shortcuts and references.

Question 19

What is a hard link?

M6: Software security - exploits and privilege escalation - C6

Answer 19

A directory entry that points to the same inode as another file, effectively creating multiple names for the same file.

Question 20

How can directory permissions affect file security?

M6: Software security - exploits and privilege escalation - C6

Answer 20

Improper permissions can allow unauthorized users to modify or replace files.

Question 21

What is the difference between signed and unsigned integers?

M6: Software security - exploits and privilege escalation - C6

Answer 21

Signed integers can represent negative values, while unsigned integers can only represent non-negative values.

Question 22

What is sign extension?

M6: Software security - exploits and privilege escalation - C6

Answer 22

Extending the sign bit of a smaller integer to a larger integer to preserve its value.

Question 23

What is zero extension?

M6: Software security - exploits and privilege escalation - C6

Answer 23

Extending a smaller unsigned integer to a larger integer by adding zeros to the higher-order bits.

Question 24

What is pointer arithmetic in C?

M6: Software security - exploits and privilege escalation - C6

Answer 24

Operations that involve adding or subtracting values from pointers, often used for array indexing.

Question 25

How can integer bugs lead to security vulnerabilities?

M6: Software security - exploits and privilege escalation - C6

Answer 25

They can cause unexpected behavior, such as buffer overflows or incorrect memory access.

Question 26

What is the carry flag (CF) used for?

M6: Software security - exploits and privilege escalation - C6

Answer 26

It indicates an overflow in unsigned arithmetic operations.

Question 27

What is the overflow flag (OF) used for?

M6: Software security - exploits and privilege escalation - C6

Answer 27

It indicates an overflow in signed arithmetic operations.

Question 28

How can developers mitigate integer bugs?

M6: Software security - exploits and privilege escalation - C6

Answer 28

By using safe integer libraries, compiler checks, and careful coding practices.

Question 29

What is the purpose of the malloc() function in C?

M6: Software security - exploits and privilege escalation - C6

Answer 29

To dynamically allocate memory at runtime.

Question 30

How can attackers exploit malloc() with integer overflows?

M6: Software security - exploits and privilege escalation - C6

Answer 30

By causing it to allocate incorrect memory sizes, leading to buffer overflows or memory corruption.