Why stack canary can be brute-force one byte at a time?

Question

I am reading brute-forcing stack canary. But I am confused why the server can be brute-forced one byte at a time on a crashable-server and what does mean this fork-and-accept ?

Answer 1

A common mistake, while programming a server, is to use a fork() to start it and respawn it when it crashes.

The problem with a fork() is that is uses a copy of the memory to start over. Of course, using a copy means that the respawned server will be stuck with the exact same canaries even if it has been crashed and respawn. Somehow, it's memory layout and it's canaries are frozen until it is really re-run from the executable file.

The good way to program a server would be to systematically use an execve() in place of the fork(). This ensure that the memory start from scratch an re-initialize all the memory settings (ASLR, canaries, and so on).

But, indeed, most of the servers in the wild are using an execve(), we can only find fork() on old implementations or on educational security challenges.