oss-security - Re: PIE bypass using VDSO ASLR weakness

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 26 Dec 2014 11:00:59 -0500 (EST)
From: cve-assign@...re.org
To: renorobert@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: PIE bypass using VDSO ASLR weakness

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Given that ASLR is not effective in VDSO and comes down to 11 quality bits
> as per pax test making return-to-vdso feasible even for PIE binary, whether
> this should be considered as a bug and CVE be assigned?

Yes, we can proceed to CVE assignment. The more recent discussion
hasn't been on oss-security with, for example:

   https://git.kernel.org/cgit/linux/kernel/git/luto/linux.git/commit/?h=x86/vdso&id=bc3b94c31d65e761ddfe150d02932c65971b74e2
   http://marc.info/?l=linux-kernel&m=141911002822659&w=2

This apparently mentions both the original discovery:

   The current algorithm is buggy: the vdso has about a 50%
   probability of being at the very end of a PMD.

and a second discovery that was made separately:

   The current algorithm also has a decent chance of failing outright
   due to incorrect handling of the case where the top of the stack is
   near the top of its PMD.

Here, our question, for anyone, is: is there a security impact from
the "failing outright" outcome? Or is there only a performance impact
(e.g., any correctly written application will continue to work, but
will not benefit from any vDSO functionality)?

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJUnYXEAAoJEKllVAevmvmsyc0H/ReEutiGsw2aw+sfLPmeGvTK
pf1pWcDyVOOllHQvPD4aF5ZwIWNDIjFV17nKq9TVg6VLr509HifeCyAdgNuU7xEU
7UWTL8JqvRmVVPz4nTqwTcF3nd4kcjdXbLvqAKah6UL2XvOikqNlJWBjqo74BRuA
a8GcSU2UbudcOlMmc0+ryueB32YLaZ7xk1rvU+7FLIP/A+tKkY8Lt0B/cJvaLVGc
QDokgodKmtm68BRw6T1jKhyY9BDH0t7Hk+t1rpHx4ArIRDboBT+wnY5v2r5o4YlJ
7wa96vAslhxzU/RnQ7m3xvlYCCpNGtNF7Kb27KtuN2nZStFwSryY7ybj8YjJs2A=
=inW/
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.