oss-security - Re: CVE request -- kernel: execshield: predictable ascii armour base address

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 20 Mar 2012 09:01:39 -0700
From: Nick Kralevich <nnk@...gle.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request -- kernel: execshield: predictable
 ascii armour base address

Can someone explain to me why this is worthy of a CVE? I can see this as a
bug of course.  But a "vulnerability"?

This bug, by itself, does not cause a vulnerability. It just makes
vulnerabilities easier to exploit. I'm not sure this is worthy of a CVE
unless we're willing to assign CVEs to all fixed address allocations.

-- Nick

On Tue, Mar 20, 2012 at 6:10 AM, Eugene Teo <eugene@...hat.com> wrote:

> On 03/20/2012 06:20 PM, Petr Matousek wrote:
> > When running a binary with a lot of shared libraries, predictable base
> > address is used for one of the loaded libraries.
> >
> > This flaw could be used to bypass ASLR.
> >
> > References:
> >
> http://scarybeastsecurity.blogspot.com/2012/03/some-random-observations-on-linux-aslr.html
> > https://bugzilla.redhat.com/show_bug.cgi?id=804947
>
> Use CVE-2012-1568.
>
> Eugene
>

-- 
Nick Kralevich | Android Security | nnk@...gle.com | 650.214.4037

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.