Runtime stack should not be executable

Question

I'm reading about security in embedded systems,and came over this statement: "The web browser’s runtime stack should not be executable.". I am well aware of what the stack is, and how it works, but I'm having a hard time understanding what it not being executable means. Does it mean that you should not be able to change the stack at runtime, or something?

Answer 1

For a Von Neumann architecture (the most common today), programs and data are stored in the same memory. So, there has to be a distionction of what is a program and what is data. Moreover, without a control of what is executed, many programs can do malicious jobs. One way to prevent malicious programs from doing bad things is, at the execution of the program, to load the code in a read only, executable memory region and to use as a stack a writable memory region that cannot be executed.

There is a thing called program counter that points to the current instruction being executed. A program may change its value to point to the stack and execute malitious instructions from there, that can be recieved over the network, for example, givin access to an unauthorized person to your machine.

Also, in the linux operating system, there is a permission system that allows you to specify whether a file can be executed or not and by which persons.

This thread: Linux process memory scheme has a pretty explicit image of how the memory of a process is organised. Only the text section, that contains code, is executabile (this means that the program counter can point to a memory cell only in that region).

Answer 2

On architectures with an MMU, a memory region may be marked with attributes for readable, writable, and executable. Regions not marked as executable, can be used only for data - an attempt to set the program counter to and fetch an instruction from this region will result in a processor exception.

A common exploit is to force an overrun of a buffer on the stack with code and a modified return value, so that when the function returns it jumps to the code in the buffer overrun. By making the stack non-executable, the exploit attempt will fail.