Hacker News Reader

Comment by CraigJPerry | Hacker News Reader

I don't know why you're being down voted. We've had ASLR in Linux for years and various attacks have been successful.

The string format attack is the one I remember most clearly which basically renders ASLR useless.

Attacker-controlled format strings are very convenient bugs, but they can't do everything. Consider the program:

    int main() {
        char buf[20];
        fgets(buf, sizeof buf, stdin);
        printf(buf);
        return 0;
    }

An attacker writing to the program's stdin can read at offsets to the stack (e.g. "%42$x"), read the contents of arbitrary non-null memory (e.g. "ABCD%5$s", where ABCD is a 32-bit memory address, and 5 is the positional parameter corresponding to the start of buf), and write an arbitrary value to an arbitrary address (e.g. "ABCD%38x%5$n", to write the value 42 to address 0x44434241).

A significant limitation of the vulnerability in the above program is the attacker can't, in a single execution of the program, read a value, then do computations on it locally, then write a value based on those computations. This flexibility is needed in order to bypass ASLR.

Kudos for the worked example!

Obviously it's not useless. Not all attackers have agreed collectively to use differents methods. Also, if it leaks in multiple points, it's better to start from a hole instead of letting it all go before finding a patch big enough for all.

Pretty much any security measure in isolation can be bypassed. So you need to stack as many as are reasonable on top of each other to limit the attacker's toolkit.

This change is basically free and makes certain things more difficult for attackers, so why not?

Reply on news.ycombinator.com