Understand Stack Canaries and How They Detect Overflows

Stack Canaries (Stack Cookies)

A stack canary is a randomly chosen value placed on the stack between local variables and the saved return address. Before the function returns, the canary is checked. If it changed, a buffer overflow occurred and the program aborts via __stack_chk_fail().

How Canaries Work

The compiler inserts checks automatically with -fstack-protector:

1. Prologue loads a canary from a thread-local variable (fs:0x28 on x64)
2. Canary sits between the buffer and the return address
3. Epilogue compares canary to the original value
4. Mismatch calls __stack_chk_fail() and terminates the process

Canary types:

• Terminator canary: contains null, newline, carriage return (stops strcpy)
• Random canary: 32-bit or 64-bit random value chosen at program start
• Random XOR canary: XORed with saved frame pointer

For This Exercise

You will demonstrate how a canary detects buffer overflow corruption and document what happens when __stack_chk_fail fires. Canaries do not prevent overflow, but they stop the attacker from controlling RIP unless they can leak the canary value first.

Bypassing Canaries

Attackers leak the canary value through format string bugs or partial reads, then include the correct canary in their overflow payload to pass the check. The canary sits in a thread-local slot at fs:0x28 on Linux x64, copied onto the stack at function entry. Building with -fstack-protector-all protects every function, not just those with char arrays, at a small performance cost.