oss-security - Re: ASLRn't is still alive and well on x86 kernels, despite CVE-2024-26621 patch

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bda1ece8-8302-4a04-9f16-c78b51b0dbb2@analygence.com>
Date: Wed, 10 Jul 2024 17:39:04 -0400
From: Will Dormann <will.dormann@...lygence.com>
To: oss-security@...ts.openwall.com
Subject: Re: ASLRn't is still alive and well on x86 kernels,
 despite CVE-2024-26621 patch

On 7/10/24 4:54 PM, Yves-Alexis Perez wrote:
> On Mon, 2024-07-08 at 12:37 -0400, Will Dormann wrote:
>>    - Modern (e.g. 6.x kernel) x86 platforms load a large-enough libc at
>> the same address every time. (i.e. no practical ASLR -- "ASLRn't")
>>    -  Modern (e.g. 6.x kernel and large-enough libc) x86_64 platforms
>> running 32-bit code will load a large-enough library at the same address
>> every time.
>>    - Modern x86_64 systems with the CVE-2024-26621 patch will randomize
>> the load address of large libraries loaded by 32-bit apps.
>>    - Modern x86 systems with the CVE-2024-26621 patch will NOT ranzomize
>> the load address of large libraries.  (i.e. is still vulnerable to
>> "ASLRn't" despite the patch)
> 
> Hey,
> 
> I'm testing on my Debian sid laptop with Linux kernel 6.9.7-1. This is amd64
> but running test-mmap built with -m32, and I get:
> 
> for i in {0..10}; do ./test-mmap < zeros; done
> mmap(NULL, 2097152, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 0, 0) = 0xf7df3000
> mmap(NULL, 2097152, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 0, 0) = 0xf7d98000
> mmap(NULL, 2097152, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 0, 0) = 0xf7d6f000



Linux 6.9.7 was released in June2024, and the patches for CVE-2024-26621 
went in months before that.  This behavior matches my 3rd bullet point 
above, so I think everything is as expected here.  ("... will randomize 
the load address of large libraries loaded by 32-bit apps.")

If you want to see the lack of randomization, try the test with an x86 
kernel, not amd64.



-WD

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.