Re: PIE bypass using VDSO ASLR weakness

[Daniel Micay <danielmicay () gmail com>]

On 09/12/14 03:05 AM, Reno Robert wrote:
> Even in 64 bit addressing, randomization of VDSO seems to be low and the
> base address could be bruteforced, thus allowing to use gadgets from VDSO
> if not from executable. Though VDSO is not rich in gadgets, it has few good
> ones to make interesting syscalls including execve(). The below blog post
> describes the availability of gadgets and feasibility of bruteforce, which
> could be combined for an effective payload.
>
> http://v0ids3curity.blogspot.in/2014/12/return-to-vdso-using-elf-auxiliary.html
>
>
> renorobert@ubuntu:~$ readelf -h ./pie
> ELF Header:
>   Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
>   Class:                             ELF64
>   Data:                              2's complement, little endian
>   Version:                          1 (current)
>   OS/ABI:                          UNIX - System V
>   ABI Version:                    0
>   Type:                              DYN (Shared object file)
>   Machine:                         Advanced Micro Devices X86-64
>   Version:                          0x1
>   Entry point address:         0x620
>
> renorobert@ubuntu:~$ while true; do ldd ./pie; done | grep
> 0x00007fff969fe000
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>         linux-vdso.so.1 =>  (0x00007fff969fe000)
>
> Do we need better ASLR for VDSO to make PIE more effective?

You must have COMPAT_VDSO enabled. It's randomized fine with a sane
kernel configuration.

Attachment: signature.asc
Description: OpenPGP digital signature