6 ms·

Time it looks like. Future versions are getting it apparently. https://wiki.freebsd.org/ASLR https://wiki.freebsd.org/ASLR

saagarjha 7y ago
But > It is disabled by default. Why?
- simcop2387 7y ago
  Judging by the fact that at least ntpd gets broken by it I suspect it's again more a time issue. It'll take time to make sure that anything broken by it either gets fixed or properly documented as needing a work-around. Otherwise when it first ships it's going to break a lot of systems when people switch.
- yjftsjthsd-h 7y ago
  FreeBSD has a very strong commitment to stability and making things work in new releases that working in old releases. This results in fairly conservative defaults.
  - moonchild 7y ago
    "Regression in FreeBSD 12.1-RELEASE-p4: the exploit I was using in -p3 is no longer usable."
- loeg 7y ago
  It is trivially bypassed and has some negative performance impact. So why enable it by default? It is left as an option for the paranoid and for "checkbox compliance" type applications.
  - saagarjha 7y ago
    Trivially bypassed if you have an address leak…
    - loeg 7y ago
      No. Trivially bypassed without a leak. Two of many examples: https://dl.acm.org/doi/10.5555/3195638.3195686 https://dl.acm.org/doi/10.5555/3195638.3195686 https://www.vusec.net/projects/anc/ https://www.vusec.net/projects/anc/ New timing attacks that break ASLR come out ~annually. These are hardware mechanisms that cannot be mitigated by software. ASLR is broken. (Nevermind ROP gadget compilers, etc.)
landr0id 7y ago
HardenedBSD (FreeBSD fork) has had ASLR and other mitigations since forever. Shawn submitted a patch that was never merged because of mailing list politics or something of that sort + people afraid it was going to break the world. https://reviews.freebsd.org/D473 https://reviews.freebsd.org/D473
- cperciva 7y ago
  > politics or something of that sort I suppose you could classify "the patch doesn't work and breaks other things besides" that way.
  - landr0id 7y ago
    HardenedBSD got the userland running fine. It was iirc mostly irrational fear by the FreeBSD team that someone's bad application would break.
    - gonzo 7y ago
      That’s not what happened.
    - loeg 7y ago
      Nope. The code had major problems that were highlighted during code review, and Shawn never fixed them.
bonzini 7y ago
What privileges does bhyve run under? Exploiting a properly sandboxed QEMU does give you access to some potentially interesting file descriptor but, unless you can use them to get kernel code execution, your process will not have access to any resources on the host that wouldn't be already accessible from inside the VM.
- saagarjha 7y ago
  There's a section on sandbox escapes.
- yjftsjthsd-h 7y ago
  Doesn't running it with KVM enabled put you back into kernel space? I'm sure doing everything in userspace is safer, but TCG is nowhere near as performant...
  - monocasa 7y ago
    The vast majority of the device emulation is in user space, even with KVM.
  - bonzini 7y ago
    KVM is indeed one of the potentially interesting file descriptors, but there is relatively little code running in kernel space.
- monocasa 7y ago
  Almost all attacks these days are a chain of exploits that each focus on jumping code execution to a new context or gaining a new privilege, that only when combined give you the access you're looking for as an attacker.

saagarjha 7y ago

But > It is disabled by default. Why?

simcop2387 7y ago
Judging by the fact that at least ntpd gets broken by it I suspect it's again more a time issue. It'll take time to make sure that anything broken by it either gets fixed or properly documented as needing a work-around. Otherwise when it first ships it's going to break a lot of systems when people switch.
yjftsjthsd-h 7y ago
FreeBSD has a very strong commitment to stability and making things work in new releases that working in old releases. This results in fairly conservative defaults.
- moonchild 7y ago
  "Regression in FreeBSD 12.1-RELEASE-p4: the exploit I was using in -p3 is no longer usable."
loeg 7y ago
It is trivially bypassed and has some negative performance impact. So why enable it by default? It is left as an option for the paranoid and for "checkbox compliance" type applications.
- saagarjha 7y ago
  Trivially bypassed if you have an address leak…
  - loeg 7y ago
    No. Trivially bypassed without a leak. Two of many examples: https://dl.acm.org/doi/10.5555/3195638.3195686 https://dl.acm.org/doi/10.5555/3195638.3195686 https://www.vusec.net/projects/anc/ https://www.vusec.net/projects/anc/ New timing attacks that break ASLR come out ~annually. These are hardware mechanisms that cannot be mitigated by software. ASLR is broken. (Nevermind ROP gadget compilers, etc.)

landr0id 7y ago

HardenedBSD (FreeBSD fork) has had ASLR and other mitigations since forever. Shawn submitted a patch that was never merged because of mailing list politics or something of that sort + people afraid it was going to break the world. https://reviews.freebsd.org/D473 https://reviews.freebsd.org/D473

cperciva 7y ago
> politics or something of that sort I suppose you could classify "the patch doesn't work and breaks other things besides" that way.
- landr0id 7y ago
  HardenedBSD got the userland running fine. It was iirc mostly irrational fear by the FreeBSD team that someone's bad application would break.
  - gonzo 7y ago
    That’s not what happened.
  - loeg 7y ago
    Nope. The code had major problems that were highlighted during code review, and Shawn never fixed them.

bonzini 7y ago

What privileges does bhyve run under? Exploiting a properly sandboxed QEMU does give you access to some potentially interesting file descriptor but, unless you can use them to get kernel code execution, your process will not have access to any resources on the host that wouldn't be already accessible from inside the VM.

saagarjha 7y ago
There's a section on sandbox escapes.
yjftsjthsd-h 7y ago
Doesn't running it with KVM enabled put you back into kernel space? I'm sure doing everything in userspace is safer, but TCG is nowhere near as performant...
- monocasa 7y ago
  The vast majority of the device emulation is in user space, even with KVM.
- bonzini 7y ago
  KVM is indeed one of the potentially interesting file descriptors, but there is relatively little code running in kernel space.
monocasa 7y ago
Almost all attacks these days are a chain of exploits that each focus on jumping code execution to a new context or gaining a new privilege, that only when combined give you the access you're looking for as an attacker.