Messages in this thread | | | From | Andy Lutomirski <> | Date | Mon, 22 Dec 2014 12:00:17 -0800 | Subject | Re: [PATCH] ASLRv3: randomize_va_space=3 preventing offset2lib attack |
| |
On Mon, Dec 22, 2014 at 11:49 AM, Jiri Kosina <jkosina@suse.cz> wrote: > On Mon, 22 Dec 2014, Andy Lutomirski wrote: > >> a. With PIE executables, the offset from the executable to the >> libraries is constant. This is unfortunate when your threat model >> allows you to learn the executable base address and all your gadgets >> are in shared libraries. > > When I was originally pushing PIE executable randomization, I have been > thinking about ways to solve this. > > In theory, we could start playing games with load_addr in > load_elf_interp() and randomizing it completely independently from mmap() > base randomization, but the question is whether it's really worth the > hassle and binfmt_elf code complication. I am not convinced.
It could be worth having a mode that goes all out: randomize every single allocation independently in, say, a 45 or 46-byte range. That would be about as strong ASLR as we could possibly have, it would result in guard intervals around mmap data allocations (which has real value), and it would still leave plenty of space for big address space hogs like the Chromium sandbox.
The main downside would be lots of memory used for page tables.
--Andy
> > -- > Jiri Kosina > SUSE Labs
-- Andy Lutomirski AMA Capital Management, LLC
| |