oss-security - Offset2lib: bypassing full ASLR on 64bit Linux

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5480C1B8.3030305@upv.es>
Date: Thu, 04 Dec 2014 21:19:04 +0100
From: Hector Marco <hecmargi@....es>
To: full-disclosure@...ts.grok.org.uk, fulldisclosure@...lists.org,
        bugtraq@...urityfocus.com, bugs@...uritytracker.com,
        submissions@...ketstormsecurity.org, oss-security@...ts.openwall.com
Subject: Offset2lib: bypassing full ASLR on 64bit Linux

Hi,

This is a disclosure of a weakness of the ASLR Linux implementation.
The problem appears when the executable is PIE compiled and it has an
address leak belonging to the executable. We named this weakness:
offset2lib.

In this scenario, an attacker is able to de-randomize all mmapped
areas (libraries, mapped files, etc.) by knowing only an address
belonging to the application and the offset2lib value.

We have built a PoC which bypasses on a 64 bit Linux system, the three
most widely adopted and effective protection techniques: No-eXecutable
bit (NX), address space layout randomization (ASLR) and stack smashing
protector (SSP). The exploit obtains a remote shell in less than one
second.

We have proposed the ASLRv3 which is a small Linux patch which removes
the offset2lib weakness.

Details of the weakness, steps to exploit the offset2lib weakness, a working
proof of concept exploit, recommendations and a demonstrative video has 
been
publish at: http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html

Hector Marco.

http://cybersecurity.upv.es

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.