Date: Tue, 09 Dec 2014 17:23:15 +0100 From: Martino Dell'Ambrogio <tillo@...lo.ch> To: oss-security@...ts.openwall.com Subject: Re: PIE bypass using VDSO ASLR weakness On 12/09/2014 04:33 PM, Reno Robert wrote: > Hi Daniel, COMPAT_VDSO is not enabled. Just that randomization is 20 bits > and same values are generated on repeated execution. I don't have the same behavior on a default linux-image-3.2.0-31-generic 3.2.0-31.50 (COMPAT_VDSO not set). I generated some values and, while distribution is not perfect, it feels fairly unpredictable : $ wc -l VDSO-ASLR.lst; cat VDSO-ASLR.lst |sort |uniq -c |sort -n -r |head; sort -u VDSO-ASLR.lst |wc -l 15798 VDSO-ASLR.lst 12 (0x00007fff4cdff000) 11 (0x00007fffd09ff000) 11 (0x00007fffc2bff000) 11 (0x00007fffa0dff000) 11 (0x00007fff4d7ff000) 11 (0x00007fff1d3ff000) 11 (0x00007fff1a1ff000) 11 (0x00007fff14dff000) 11 (0x00007fff0e9ff000) 10 (0x00007fffe1dff000) 9869 This is 9869 different results over 15798 samples, with a very light shift toward the shown addresses. What's weird, though, is that a run of the same set through Burp Suite analysis tells me that there are at best 8 estimated bits of effective entropy. This suggests, if my interpretation is correct, that there may be some weakness (by calculating adjacent and/or subsequent values) allowing to find a valid combination under 256 tries. I'm not a cryptologist so I may be missing a point here, but I think it's worth discussing. Martino Dell'Ambrogio Security Auditor Web: http://www.tillo.ch/ Email: tillo@...lo.ch Content of type "text/html" skipped Download attachment "egbicfje.png" of type "image/png" (27918 bytes) Download attachment "smime.p7s" of type "application/pkcs7-signature" (4234 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.