Re: [PATCH] ASLRv3: randomize_va_space=3 preventing offset2lib attack
From: Hector Marco
Date: Fri Dec 12 2014 - 11:34:36 EST
I agree. I don't think a new randomization mode will be needed, just fix
the current randomize_va_space=2. Said other way: fixing the offset2lib
will not break any current program and so, no need to add additional
configuration options. May be we shall wait for some inputs
from the list (may be we are missing something).
Regarding to VDSO, definitively, is not randomized enough in 64bits.
Brute force attacks would be pretty fast even from the network.
I have identified the bug and seems quite easy to fix it.
On 32bit systems, this is not a issue because it is mapped in the
mmap area. In order to fix the VDSO on 64bit, the following
It seems (reading the kernel comments) that the random allocation
algorithm tries to place the VDSO in the same PTE than the stack.
But since the permissions of the stack and the VDSO are different
it seems that are getting right the opposite.
Effectively VDSO shall be correctly randomized because it contains
enough useful exploitable stuff.
I think that the possible solution is follow the x86_32 approach
which consist on map the VDSO in the mmap area.
It would be better fix VDSO in a different patch ? I can send a
patch which fixes the VDSO on 64 bit.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/