lkml.org 
[lkml]   [2020]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v4] mm: Optional full ASLR for mmap() and mremap()
    From
    Date
    On 19.11.2020 0.42, Jann Horn wrote:
    > On Tue, Nov 17, 2020 at 5:55 PM Matthew Wilcox <willy@infradead.org> wrote:
    >> On Mon, Oct 26, 2020 at 06:05:18PM +0200, Topi Miettinen wrote:
    >>> Writing a new value of 3 to /proc/sys/kernel/randomize_va_space
    >>> enables full randomization of memory mappings created with mmap(NULL,
    >>> ...). With 2, the base of the VMA used for such mappings is random,
    >>> but the mappings are created in predictable places within the VMA and
    >>> in sequential order. With 3, new VMAs are created to fully randomize
    >>> the mappings. Also mremap(..., MREMAP_MAYMOVE) will move the mappings
    >>> even if not necessary.
    >>
    >> Is this worth it?
    >>
    >> https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/aslrcache-practical-cache-attacks-mmu/
    >
    > Yeah, against local attacks (including from JavaScript), ASLR isn't
    > very robust; but it should still help against true remote attacks
    > (modulo crazyness like NetSpectre).
    >
    > E.g. Mateusz Jurczyk's remote Samsung phone exploit via MMS messages
    > (https://googleprojectzero.blogspot.com/2020/08/mms-exploit-part-5-defeating-aslr-getting-rce.html)
    > would've probably been quite a bit harder to pull off if he hadn't
    > been able to rely on having all those memory mappings sandwiched
    > together.

    Compiling the system with -mcmodel=large should also help, since then
    even within one library, the address space layout of various segments
    (text, data, rodata) could be randomized individually and then finding
    the XOM wouldn't aid in finding the other segments. But this model isn't
    so well supported yet (GCC:
    https://gcc.gnu.org/onlinedocs/gcc/AArch64-Options.html, not sure about
    LLVM).

    -Topi

    \
     
     \ /
      Last update: 2020-11-19 10:18    [W:2.481 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site