[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20141205153732.64382590@pc>
Date: Fri, 5 Dec 2014 15:37:32 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: Offset2lib: bypassing full ASLR on 64bit Linux
On Fri, 05 Dec 2014 14:30:31 +0100
Florian Weimer <fweimer@...hat.com> wrote:
> On 12/05/2014 01:54 PM, Hanno Böck wrote:
> > Most distros don't ship pic/pie executables by default. Why? I
> > haven't done benchmarks, the saying is that this has a notable
> > performance hit on 32 bit but almost none on 64 bit. If this is
> > true then could we at least have all major distros enable it on 64
> > bit?
>
> Copy relocations support has still be added to GCC. For x86_64, a
> patch exists:
>
> https://gcc.gnu.org/ml/gcc-patches/2014-05/msg01215.html
>
> Without that, there is still a performance impact.
Interesting.
Do you know the state of this? The thread indicates that the poster
asked for review of his patch and never got one.
Any gcc people here who could comment?
Do you have numbers on the performance impact? Or some good ideas what
would be reasonable benchmarking targets?
As libraries are pic-compiled anyway from my limited understanding I
think this only affects code in the main executables.
I saw that chrome already ships pie-binaries, firefox doesn't.
(Browsers seem like performance critical, so google seems to think it's
no big performance deal).
> > What i found notable: diff-ing two function offsets from different
> > libraries (I use printf-sin) is alway static, even on Pax. Is this
> > by design?
>
> Yes, the address you get is the PLT stub, not the actual
> implementation. The reason for this is somewhat complex, but related
> to the way lazy binding and symbol interposition are implemented.
"somewhwat complex" seems to be a reasonable description when it comes
to this whole topic of memory exploit mitigation :-) I feel I'd like to
know more about this but easy-to-grasp documentation / talks etc. are
hard to find.
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
