3

Assume a simple struct:

struct test {
   char variable[4];
   char variable2;
}

If I write something like variable[4] = '\0' there is a buffer overflow which modifies variable2.

Does ASLR prevent this buffer overflow?

6

ASLR never prevents any buffer overflow. A buffer overflow is when the application writes more bytes in a buffer than can possibly fit; putting the buffer at any random address cannot fix that.

What ASLR changes is the consequences of the overflow. A buffer overflow is exploited by an attacker by trying to making the extra bytes spill over some other elements in a controlled way. ASLR makes that more difficult in two ways:

  • By "moving things around", the field that the attacker tries to overwrite will not necessarily be located at a predictable place beyond the overflowing buffer.
  • A classic overflow exploit is about overwriting a jump field (return address on the stack, vtable for a C++ object...) so that execution jumps elsewhere; ASLR tries to force a blind jump which is unlikely to go anywhere interesting (for the attacker).

In the case of a struct, ASLR will not separate the two structure fields, because that would be contrary to the C specification, and it would break code. Regardless of ASLR, the variable2 field will always be right after the variable buffer in RAM, so the buffer overflow will predictably overwrite variable2. However, ASLR still moves code chunks between two executions of the application, so overwriting variable2 might not be sufficient to, say, inject arbitrary code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.