oss-security - Re: PIE bypass using VDSO ASLR weakness

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <548721F3.9090206@tillo.ch>
Date: Tue, 09 Dec 2014 17:23:15 +0100
From: Martino Dell'Ambrogio <tillo@...lo.ch>
To: oss-security@...ts.openwall.com
Subject: Re: PIE bypass using VDSO ASLR weakness

On 12/09/2014 04:33 PM, Reno Robert wrote:
> Hi Daniel, COMPAT_VDSO is not enabled. Just that randomization is 20 bits
> and same values are generated on repeated execution.
I don't have the same behavior on a default linux-image-3.2.0-31-generic 
3.2.0-31.50 (COMPAT_VDSO not set).

I generated some values and, while distribution is not perfect, it feels 
fairly unpredictable :

$ wc -l VDSO-ASLR.lst; cat VDSO-ASLR.lst |sort |uniq -c |sort -n -r 
|head; sort -u VDSO-ASLR.lst |wc -l
15798 VDSO-ASLR.lst
      12 (0x00007fff4cdff000)
      11 (0x00007fffd09ff000)
      11 (0x00007fffc2bff000)
      11 (0x00007fffa0dff000)
      11 (0x00007fff4d7ff000)
      11 (0x00007fff1d3ff000)
      11 (0x00007fff1a1ff000)
      11 (0x00007fff14dff000)
      11 (0x00007fff0e9ff000)
      10 (0x00007fffe1dff000)
9869

This is 9869 different results over 15798 samples, with a very light 
shift toward the shown addresses.

What's weird, though, is that a run of the same set through Burp Suite 
analysis tells me that there are at best 8 estimated bits of effective 
entropy.
This suggests, if my interpretation is correct, that there may be some 
weakness (by calculating adjacent and/or subsequent values) allowing to 
find a valid combination under 256 tries.

I'm not a cryptologist so I may be missing a point here, but I think 
it's worth discussing.

Martino Dell'Ambrogio
Security Auditor
Web: http://www.tillo.ch/
Email: tillo@...lo.ch

Content of type "text/html" skipped

Download attachment "egbicfje.png" of type "image/png" (27918 bytes)

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4234 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.