PIE bypass using VDSO ASLR weakness

[Reno Robert <renorobert () gmail com>]

Even in 64 bit addressing, randomization of VDSO seems to be low and the
base address could be bruteforced, thus allowing to use gadgets from VDSO
if not from executable. Though VDSO is not rich in gadgets, it has few good
ones to make interesting syscalls including execve(). The below blog post
describes the availability of gadgets and feasibility of bruteforce, which
could be combined for an effective payload.

http://v0ids3curity.blogspot.in/2014/12/return-to-vdso-using-elf-auxiliary.html


renorobert@ubuntu:~$ readelf -h ./pie
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                          1 (current)
  OS/ABI:                          UNIX - System V
  ABI Version:                    0
  Type:                              DYN (Shared object file)
  Machine:                         Advanced Micro Devices X86-64
  Version:                          0x1
  Entry point address:         0x620

renorobert@ubuntu:~$ while true; do ldd ./pie; done | grep
0x00007fff969fe000
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)
        linux-vdso.so.1 =>  (0x00007fff969fe000)

Do we need better ASLR for VDSO to make PIE more effective?

-- 
Regards,
Reno Robert
http://v0ids3curity.blogspot.in/