oss-security - PIE bypass using VDSO ASLR weakness

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAH4rwTL-nYktGhf+npph+u_XBxWHk9J=jp2gCWpCRU1+_moosg@mail.gmail.com>
Date: Tue, 9 Dec 2014 13:35:16 +0530
From: Reno Robert <renorobert@...il.com>
To: oss-security@...ts.openwall.com
Subject: PIE bypass using VDSO ASLR weakness

Even in 64 bit addressing, randomization of VDSO seems to be low and the
base address could be bruteforced, thus allowing to use gadgets from VDSO
if not from executable. Though VDSO is not rich in gadgets, it has few good
ones to make interesting syscalls including execve(). The below blog post
describes the availability of gadgets and feasibility of bruteforce, which
could be combined for an effective payload.

http://v0ids3curity.blogspot.in/2014/12/return-to-vdso-using-elf-auxiliary.html


renorobert@...ntu:~$ readelf -h ./pie
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                          1 (current)
  OS/ABI:                          UNIX - System V
  ABI Version:                    0
  Type:                              DYN (Shared object file)
  Machine:                         Advanced Micro Devices X86-64
  Version:                          0x1
  Entry point address:         0x620

renorobert@...ntu:~$ while true; do ldd ./pie; done | grep
0x00007fff969fe000
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)

Do we need better ASLR for VDSO to make PIE more effective?

-- 
Regards,
Reno Robert
http://v0ids3curity.blogspot.in/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.