2

According to Wiki, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries.

Conceptually, ASLR prevents buffer overflow exploits that rely on knowledge of the process memory address layout. While I understand that the more randomization the better, would it be useful to only randomize the base of the executable, and leave the rest unchanged, relative to this base? If an attacker has trouble getting the base address of the executable, he will have trouble getting the base address of other areas of the executable, right? Or am I missing something?

Improve this question
1
  • hardenedbsd.org/content/… may be helpful (as you are roughly describing ASR which randomizes base and mmap(), rather than ASLR).
    – forest
    Commented Dec 19, 2017 at 7:57

1 Answer 1

Reset to default
2

No. Many attacks rely on the address of a library routine, and don't care where the executable is loaded. Pretty much any fixed address can be exploited.

Improve this answer
7
  • Let's say we have an executable that, without ASLR, always starts at memory 0x1000. Library A of that executable always starts at 0x1100. Now, with ASLR implemented only on the base address of the executable, let's say we have a slide of 16 possible locations, i.e. base address could be 0x1000-0x1010, and since the library also slides together with the executable, so it could be 0x1100-0x1110. In this case, wouldn't the attacker need to guess up to 16 library addresses as well?
    – user1118764
    Commented Oct 27, 2016 at 3:42
  • There are "find" routines that can be used to locate the desired syscalls. Once they are located, they can be hardcoded accordingly. As John stated, any fixed address (even relatively fixed) can be exploited.
    – HashHazard
    Commented Oct 27, 2016 at 3:58
  • Depending on the OS, libraries can be loaded at fixed or preferred addresses. If you're talking about statically linked libraries, a relative branch would be unaffected if the distance between the executable and the library was unchanged.
    – John Deters
    Commented Oct 27, 2016 at 3:58
  • @Hollowproc could you briefly describe, or point me to information on these find routines, and how relatively fixed addresses can be exploited?
    – user1118764
    Commented Oct 27, 2016 at 4:07
  • @JohnDeters by unaffected, do you mean they can be exploited as if the base address of the executed wasn't randomized? I guess I'm struggling to understand how it can be exploited.
    – user1118764
    Commented Oct 27, 2016 at 4:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .