4

Wikipedia says Linux kernel has a weak form of ASLR by default and only adding PaX or Exec Shield patches enables complete ASLR.

What is the weakness of default ASLR in Linux kernel? Has it been fixed/improved in recent versions? If not, is there a reason why the mainline kernel chooses to not provide a complete implementation?

1

The Wikipedia article continues:

This places the stack base in an area 8 MB wide containing 524,288 possible positions; and the mmap base in an area 1 MB wide containing 256 possible positions.

The latter is way too small to be effective, and an attacker only needs to probe 256 addresses in one segment to find the mmap() address pointer.

What the article doesn't mention is the limited use of ASLR in Linux. Traditionally the 2.6 kernel only used ASLR for (network) processes in specific memory areas (when PIE compiled) while loading the VDSO to a fixed address. Such a measure is only effective if all the addresses are randomized. Newer kernels have better support for address randomization. Note that various Windows versions did the exact same thing.

  • Thank you. Are the randomization spaces still same in latest kernel? If so, why are they not changed? – Chandra Sekar Sep 7 '16 at 8:02
  • @Chandru They have changed in the 4.8 release. Now including support for random mappings, virtual allocations and physical mappings. This has also made its way to the KASLR lkml.iu.edu/hypermail/linux/kernel/1607.3/00404.html – Yorick de Wid Sep 7 '16 at 8:10
  • @YorickdeWid KASLR is a completely different technology of questionable effectiveness, related only to ASLR in name. – forest Dec 16 '17 at 4:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.