PaX and buffer overflows

Question

Is buffer overflow possible on Linux that has PaX in the kernel. I want to use an executable by changing the return address using the correct input. I am using Ubuntu 10.04 and I am testing this with paxtest, but I do not understand what the result means. This is the result of paxtest on my system:

  Executable anonymous mapping: Killed
 Executable bss: Killed
 Executable data: Killed
 Executable heap: Killed
 Executable stack: Killed
 Executable anonymous mapping (mprotect): Vulnerable
 Executable bss (mprotect): Vulnerable
 Executable data (mprotect): Vulnerable
 Executable heap (mprotect): Vulnerable
 Executable shared library bss (mprotect): Vulnerable
 Executable shared library data (mprotect): Vulnerable
 Executable stack (mprotect): Vulnerable
 Anonymous mapping randomisation test: 12 bits (guessed)
 Heap randomisation test (ET_EXEC): 13 bits (guessed)
 Heap randomisation test (ET_DYN): 14 bits (guessed)
 Main executable randomisation (ET_EXEC): 12 bits (guessed)
 Main executable randomisation (ET_DYN): 12 bits (guessed)
 Shared library randomization test: 12 bits (guessed)
 Stack randomization test (SEGMEXEC): 19 bits (guessed)
 Stack randomization test (PAGEEXEC): 19 bits (guessed)
 Return to function (strcpy): Vulnerable
 Return to function (strcpy, RANDEXEC): Vulnerable
 Return to function (memcpy): Vulnerable
 Return to function (memcpy, RANDEXEC): Vulnerable
 Executable shared library bss: Vulnerable
 Executable shared library data: Killed
 Writable text segments: Vulnerable

Answer 1

Yes, you can. See Lines:

Return to function (strcpy) : Vulnerable Return to function (strcpy, RANDEXEC) : Vulnerable 

Alas, my school project was supposed to prevent such an exploit using grsecurity. PaX did not stop me from rewriting the return address.