[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAH4rwTLAG5Mg1ZsDkStGs+_MitJ_4Z5FgVp=AdcDBN6Jkk44kw@mail.gmail.com>
Date: Tue, 9 Dec 2014 21:03:51 +0530
From: Reno Robert <renorobert@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: PIE bypass using VDSO ASLR weakness
Hi Daniel, COMPAT_VDSO is not enabled. Just that randomization is 20 bits
and same values are generated on repeated execution.
On Tue, Dec 9, 2014 at 2:08 PM, Daniel Micay <danielmicay@...il.com> wrote:
> On 09/12/14 03:05 AM, Reno Robert wrote:
> > Even in 64 bit addressing, randomization of VDSO seems to be low and the
> > base address could be bruteforced, thus allowing to use gadgets from VDSO
> > if not from executable. Though VDSO is not rich in gadgets, it has few
> good
> > ones to make interesting syscalls including execve(). The below blog post
> > describes the availability of gadgets and feasibility of bruteforce,
> which
> > could be combined for an effective payload.
> >
> >
> http://v0ids3curity.blogspot.in/2014/12/return-to-vdso-using-elf-auxiliary.html
> >
> >
> > renorobert@...ntu:~$ readelf -h ./pie
> > ELF Header:
> > Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
> > Class: ELF64
> > Data: 2's complement, little endian
> > Version: 1 (current)
> > OS/ABI: UNIX - System V
> > ABI Version: 0
> > Type: DYN (Shared object file)
> > Machine: Advanced Micro Devices X86-64
> > Version: 0x1
> > Entry point address: 0x620
> >
> > renorobert@...ntu:~$ while true; do ldd ./pie; done | grep
> > 0x00007fff969fe000
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> > linux-vdso.so.1 => (0x00007fff969fe000)
> >
> > Do we need better ASLR for VDSO to make PIE more effective?
>
> You must have COMPAT_VDSO enabled. It's randomized fine with a sane
> kernel configuration.
>
>
--
Regards,
Reno Robert
http://v0ids3curity.blogspot.in/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
