Address space layout randomization PaX

1 address space layout randomization

1.1 randomized stack base
1.2 randomized mmap() base
1.3 randomized et_exec base

address space layout randomization

address space layout randomization, or aslr, technique of countering arbitrary execution of code, or ret2libc attacks. these attacks involve executing existing code out of order intended programmer.

fig. 2 distance between various areas of memory randomly selected, indicated half-head arrow. example, gap between stack , top of memory random in magnitude.

aslr provided in pax shuffles stack base , heap base around in virtual memory when enabled. optionally randomizes mmap() base , executable base of programs. substantially lowers probability of successful attack requiring attacking code guess locations of these areas.

fig. 2 shows qualitative views of process address spaces address space layout randomization. half-head arrows indicate random gap between various areas of virtual memory. @ point when kernel initializes process, length of these arrows can considered grow longer or shorter template independent of each other.

during course of program s life, heap, called data segment or .bss, grow up; heap expands towards highest memory address available. conversely, stack grows down, towards lowest memory address, 0.

it extremely uncommon program require large percent of address space either of these. when program libraries dynamically loaded @ start of program operating system, placed before heap; however, there cases program load other libraries, such commonly referred plugins, during run. operating system or program must choose acceptable offset place these libraries at.

pax leaves portion of addresses, msbs, out of randomization calculations. helps assure stack , heap placed not collide each other, , libraries placed stack , heap not collide them.

the effect of randomization depends on cpu. 32-bit cpus have 32 bits of virtual address space, allowing access 4gib of memory. because linux uses top 1 gb kernel, shortened 3gib. segmexec supplies split down middle of 3gib address space, restricting randomization down 1.5gib. pages 4kib in size, , randomizations page aligned. top 4 msbs discarded in randomization, heap exists @ beginning , stack @ end of program. computes down having stack , heap exist @ 1 of several million positions (23 , 24 bit randomization), , libraries existing in of approximately 65,000 positions.

on 64-bit cpus, virtual address space supplied mmu may larger, allowing access more memory. randomization more entropic in such situations, further reducing probability of successful attack in lack of information leak.

randomized stack base

pax randomly offsets base of stack in increments of 16 bytes, combining random placement of actual virtual memory segment sub-page stack gap. total magnitude of randomization depends on size of virtual memory space; example, stack base somewhere in 256mib range on 32-bit architectures, giving 16 million possible positions or 24 bits of entropy.

fig. 3 stack smashing attack. target of attack keeps same address; payload moves stack.

the randomization of stack base has effect on payload delivery during shellcode , return-to-libc attacks. shellcode attacks modify return pointer field address of payload; while return-to-libc attacks modify stack frame pointer. in either case, probability of success diminished significantly; position of stack unpredictable, , missing payload causes program crash.

in case of shellcode, series of instructions called nop slide or nop sled can prepended payload. add 1 more success case per 16 bytes of nop slide. 16 bytes of nop slide increase success rate 1/16m 2/16m; 128 bytes of nop slide increase 9/16m. increase in success rate directly proportional size of nop slide; doubling length of given nop slide doubles chances of successful attack.

return-to-libc attacks not use code, rather inject fixed width stack frames. because of this, stack frames have repeat aligned 16 bytes. stack frame bigger this, giving repeated stack frame payloads of same length given nop sled less of impact on success rate of attacks.

randomized mmap() base

in posix systems, mmap() system call allows memory allocated @ offsets specified process or selected kernel. can anonymous memory nothing in it; or file backed memory mappings, simulate portion of file or copy of said portion in memory @ point. program libraries loaded in using mmap() map code , data private—the files copied memory if changed, rather rewritten on disk.

any mmap() call may or may not specify offset in virtual memory allocate mapping at. if offset not specified, operating system select one. linux calculating offset in predictable manner, starting predefined virtual address called mmap() base. because of this, every run of process loads initial libraries such c standard library or libc in same place.

when randomized mmap() base enabled, pax randomly shifts mmap() base, affecting positioning of libraries , other non-specific mmap() calls. causes dynamically linked code, i.e. shared objects, mapped @ different, randomly selected offset every time. attackers requiring function in library must guess library loaded in virtual memory space call it. makes return-to-libc attacks difficult; although shellcode injections can still address of function in global offset table.

pax not change load order of libraries. means if attacker knows address of 1 library, can derive locations of other libraries; however, notable there more serious problems if attacker can derive location of library in first place, , randomization not that. further, typical attacks require finding 1 library or function; other interesting elements such heap , stack separately randomized , not derivable mmap() base.

when et_dyn executables—that is, executables compiled position independent code in same way shared libraries—are loaded, base randomly chosen, mmap()ed ram regular shared objects.

when combining non-executable stack mmap() base randomization, difficulty in exploiting bugs protected against pax increased due forced use of return-to-libc attacks. on 32-bit systems, amounts 16 orders of magnitude; is, chances of success recursively halved 16 times. combined stack randomization, effect can quite astounding; if every person in world (assuming 6 billion total) attacks system once, 1 2 should succeed on 32-bit system. 64-bit systems of course benefit greater randomization.

randomized et_exec base

pax able map non-position-independent code randomly ram; however, poses few problems. first, incurs performance overhead. second, on rare occasions causes false alarms, bringing pax kill process no reason. recommended executables compiled et_dyn, 100% position independent code.

the randomization of executable load base et_exec fixed position executables affected security flaw in vm mirroring code in pax. hadn t upgraded, flaw worked around disabling segmexec nx bit emulation , randexec randomization of executable base.