[lkml]   [2014]   [Dec]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] ASLRv3: randomize_va_space=3 preventing offset2lib attack
On Mon, 22 Dec 2014, Andy Lutomirski wrote:

> a. With PIE executables, the offset from the executable to the
> libraries is constant. This is unfortunate when your threat model
> allows you to learn the executable base address and all your gadgets
> are in shared libraries.

When I was originally pushing PIE executable randomization, I have been
thinking about ways to solve this.

In theory, we could start playing games with load_addr in
load_elf_interp() and randomizing it completely independently from mmap()
base randomization, but the question is whether it's really worth the
hassle and binfmt_elf code complication. I am not convinced.

Jiri Kosina

 \ /
  Last update: 2014-12-22 21:21    [W:0.088 / U:0.048 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site