[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54879BCE.9030107@gmail.com>
Date: Tue, 09 Dec 2014 20:03:10 -0500
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Offset2lib: bypassing full ASLR on 64bit Linux
On 09/12/14 11:18 AM, Steve Grubb wrote:
>
> 4) Then I started wondering about the heap when you use other memory manager
> libraries such as jemalloc. This turned out to be interesting. You get about
> 19 bits of randomness using it. Its not as bad as non-PIE glibc but not as
> good as PIE glibc. You also got the same amount of randomness whether the app
> was PIE or not. This is an area ripe for more experimenting, exploiting, and
> patching. Supposedly some of these heap managers use mmap as the underlying
> allocator. So, why aren't they getting 29 bits, too? :-)
Your measurement of the difference is quite accurate.
The page multiple constraint zaps 12 potential bits of entropy, but
jemalloc's 4M chunk alignment increases that to 22 bits. I'm not sure
what can be done about it because there's a very strong performance case
for the design.
I sent in a fix for the MALLOC_CONF part of this at least, so an
attacker won't be able to reduce it further:
https://github.com/jemalloc/jemalloc/pull/174
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
