Re: [BUG] perf: bogus correlation of kernel symbols

[Kees Cook]

On Fri, May 20, 2011 at 11:14:09AM -0700, Linus Torvalds wrote:
> On Fri, May 20, 2011 at 10:41 AM, Dan Rosenberg
> <drosenberg@xxxxxxxxxxxxx> wrote:
> >
> > Also, I'd still welcome suggestions on generating entropy so early in
> > the boot process as to randomize the location at which the kernel is
> > decompressed.
> 
> The fundamental problem with the whole kernel address randomization is
> sadly totally unrelated to any of the small details.
> 
> There's a *big* detail that makes it hard: there's only a few bits of
> randomness we can add to the address. The kernel base address ends up
> having various fundamental limitations (cacheline alignment for the
> code, and we have several segments that require page alignment), so
> you really can't realistically do more than something like 8-12 bits
> of address randomization.
> 
> Which means that once you have a vmlinux image (say, because it's a
> standard distro kernel), you only need to try your exploit a few
> hundred times. That can be done quickly enough that no MIS person will
> ever have time to react to the attack.
> 
> Sure, it will likely leave some hints around (oopses etc), but still..

Certain flaws will present that way, yes. Others will take the entire
system down on the first missed address guess. Many times, ASLR will
give a statistical advantage to the defender. As a result it has value,
even if it's not perfect.

-Kees

-- 
Kees Cook
Ubuntu Security Team
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/