Stack Frame Canary Validation
Description
Comparing a value stored in a stack frame with a known good value in order to prevent or detect a memory segment overwrite.
Mapped SPARTA techniques
4 techniques
Derived by composition, not from a source that names this pair. D3FEND publishes that Stack Frame Canary Validation counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009 as addressing that same adversary behaviour in the space domain. Stack canaries are a compile-time property of the software, so they apply to flight software built with the same protections. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Derived by composition, not from a source that names this pair. D3FEND publishes that Stack Frame Canary Validation counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009.01 as addressing that same adversary behaviour in the space domain. Stack canaries are a compile-time property of the software, so they apply to flight software built with the same protections. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Derived by composition, not from a source that names this pair. D3FEND publishes that Stack Frame Canary Validation counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009.02 as addressing that same adversary behaviour in the space domain. Stack canaries are a compile-time property of the software, so they apply to flight software built with the same protections. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Derived by composition, not from a source that names this pair. D3FEND publishes that Stack Frame Canary Validation counters T1203 Exploitation for Client Execution; SafeMode's curated mapping records EX-0009.03 as addressing that same adversary behaviour in the space domain. Stack canaries are a compile-time property of the software, so they apply to flight software built with the same protections. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.
Cross-framework references
Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.
Cite as SafeMode Space, d3fend D3-SFCV.