Windows update harbors AMD conflict

TalkBack 37 of 99:

Next »

« Previous

• Thread View
• Flat View

Not quite true.

While I'm no big fan of either MS or Intel, this wasn't planned by either of them, nor is it in any way their own fault.

The fault lies in the driver for the Hollywood DVD PCI card. It violates a basic rule of programming on memory-managed OSes and CPUs (including all 32-bit and 64-bit CPUs, regardless of manufacturer): do not put executable code into memory that is not specifically allocated to your application and specifically allocated for the purpose of holding executable code, and executing it.

The driver has executable code mixed in with data and placed in an area allocated for data, not code. This was bad all along, but the badness only became apparent when you install SP2 and use it with a CPU that enforces No-Execute status on memory blocks allocated for data. To date, only the AMD 64-bit CPUs actually enforce this, and then only with an OS that helps, and the first version of Windows to do so is XP SP2. But Intel is already readying Xeons and Pentiums with their own version of No-Execute (I believe that they call theirs "Execute Disable," but it's the same thing), and the same "problem" would happen with them.

The purpose of No Execute / Execute Disable is to block what is BY FAR the most common cause of the security vulnerabilities that have long plagued Windows in general: unchecked buffer and stack overflows in systems-level software or software applications or drivers running with enhanced privileges. If code is allowed to execute in a data-only area, then a tricky hacker can force a buffer or stack overflow in any of a vast number of ways (look carefully at the descriptions of most of those smaller Critical Updates that Windows Update asks you to install from time to time -- most of them will be about "buffer overflows"), and stick executable code into the overflow, tricking the CPU into executing it with the same privileges as the program which allocated the buffer (often part of Windows itself, or a Windows system-level program, or device driver, etc.). This means that such code can blow right past most of the protections inherent in Windows, and do absolutely ANYTHING that the hacker desires. That could be anything from deleting important system files and thus crashing your system, to more subtle but more dangerous things like watching you type your passwords and credit card numbers and the like into your Web browser, then sending those back to the virus writer on the sly (after all, you can always re-install your OS or applications, but if your identity is stolen, your life is basically screwed for quite some time while you try to repair the damage to your very identity).

By enforcing data-only (no execute) status on such buffers, ALL buffer-overflow attacks and exploits are blocked, since the CPU will flatly refuse to execute ANY executable code that is not residing in a memory area specifically allocated for executable code!

In other words, the problem happened precisely because both SP2 and the AMD 64-bit chips are doing EXACTLY WHAT THEY WERE ADVERTISED TO DO. Again, this SAME problem would show up on the forthcoming Intel CPUs with Execute Disable.

I'm just surprised that only one ancient driver for one ancient piece of hardware has so far shown this problem. It's amazing that (so far) only one program still out there was written by some hack programmer who didn't think that following the rules of memory management applied to him/her.

Posted by: Joel R   Posted on: 08/28/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now
• SOA for Dummies 2nd IBM Limited Edition Mini eBook IBM Learn the basics of SOA by following 7 real-life companies as they experience the truly game-changing effects of this important technology initiative. Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now