[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5486B508.6070107@gmail.com>
Date: Tue, 09 Dec 2014 03:38:32 -0500
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: PIE bypass using VDSO ASLR weakness
On 09/12/14 03:05 AM, Reno Robert wrote:
> Even in 64 bit addressing, randomization of VDSO seems to be low and the
> base address could be bruteforced, thus allowing to use gadgets from VDSO
> if not from executable. Though VDSO is not rich in gadgets, it has few good
> ones to make interesting syscalls including execve(). The below blog post
> describes the availability of gadgets and feasibility of bruteforce, which
> could be combined for an effective payload.
>
> http://v0ids3curity.blogspot.in/2014/12/return-to-vdso-using-elf-auxiliary.html
>
>
> renorobert@...ntu:~$ readelf -h ./pie
> ELF Header:
> Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
> Class: ELF64
> Data: 2's complement, little endian
> Version: 1 (current)
> OS/ABI: UNIX - System V
> ABI Version: 0
> Type: DYN (Shared object file)
> Machine: Advanced Micro Devices X86-64
> Version: 0x1
> Entry point address: 0x620
>
> renorobert@...ntu:~$ while true; do ldd ./pie; done | grep
> 0x00007fff969fe000
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
> linux-vdso.so.1 => (0x00007fff969fe000)
>
> Do we need better ASLR for VDSO to make PIE more effective?
You must have COMPAT_VDSO enabled. It's randomized fine with a sane
kernel configuration.
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
