I know all about how ASLR works, and how it has been implemented on both Linux and Windows systems. It provides an extra layer of protection that malware has to take into account. But nowadays with computers being left on for long periods of time ASLR doesn't seem to randomize the address space as much as we would like. Windows 8 has taken extra steps to ensure that ASLR is effective.
I just found out about kernel level ASLR when I built and upgraded my Linux kernel, and noticed that on boot it said:
KASLR not enabled
After doing some searching I didn't find that much on KASLR in general. So now I'm curious if anyone here has experience with it.
- Is KASLR worth it? Does it provide a significant advantage? I would have to rebuilt my kernel, configure it for KASLR and all that jazz. Not terrible, but slightly annoying.
- Does this exist in the Windows world? If so, does Windows do a better job at its implementation?
Or maybe the world just isn't ready for it yet...