I was trying out how ASLR works in Centos 7.2.1115 x86_64 specifically.
Here are my /proc/$pid/maps
dumps from two runs of Firefox (on Pastebin):
#1
#2
Basically, ASLR works. It randomizes .data and .text offsets.
However, it packs all libraries and executable in the same order and without gaps. (Well, mostly. There are couple variations, but they look purely accidental.)
So, as soon as single address gets compromised, this whole part of ASLR goes out of the window.
My question is, is it the common case as of now? What systems address this issue and how?
I mean, 64-bit address space is huge, you could just randomly throw each library at it and then check if it overlaps with anything, and successfully place it after a couple retries at most. Yet, the best already implemented solution I found by googling is library load order randomization on Android.