Bypassing Address Space Layout Randomization

Question

How effective is ASLR in preventing arbitrary code execution in a buffer overflow type exploit? How hard is it for an attacker to bypass this without simply guessing where the addresses are?

Answer 1

ASLR is a defense-in-depth mechanism. It is effective, but can be bypassed (the 2010 PWN2OWN contest break included an ASLR bypass).

ASLR's primary purpose is to defeat "ret-to-libc" attacks which are a mechanism of bypassing DEP. IMHO ASLR is only really effective when bundled with other protection mechanisms like DEP (ASLR without DEP can typically be trivially bypassed).

Answer 2

Mark Dowd and Alex Sotirov - Black Hat 2008 are the experts on defeating ASLR.

Alex Sotirov and I are presenting at BlackHat USA today on bypassing the Windows Vista memory protections in the context of the web browser in a speech titled “How to Impress Girls with Browser Memory Protection Bypasses”. Specifically, we will be discussing how rich browser functionality can be utilized to help lessen the impact of memory protections (and in some cases, completely negate them). Some of the techniques we will be discussing are known ones, whereas others are new approaches that we haven’t seen discussed in public forums before.

Answer 3

ASLR strength also depends on the architecture used. Under x86 your virtual address is limited to 4 bytes, which gives you only 2 possible bytes for randomization (taking into account the memory granularity), while x64 gives you much more freedom to randomize the localization.

Imagine you attack the server 32-bit program, which continues its execution after the crash (restarted by the watchdog, for instance). In this case you could just bruteforce the return address with your exploit, while it is considered impossible for x64-application (to the best of my knowledge).