4 ms·

Can you recommend any new ones you like?

• wahern 6y ago
  In this case you can just read the previous paper, which explains the caveat that PIE daemons utilizing ASLR must be so-called fork-only services--i.e. forked from a supervisor process. If they're not fork-only than you can't leak the address space layout. The suggested counter measure is to re-exec child processes so their address space is re-randomized. OpenSSH began doing this by default 10 years before the above paper: https://github.com/openbsd/src/commit/5541d005bde289515d9734dbcd513ec43bd182d2 https://github.com/openbsd/src/commit/5541d005bde289515d9734... Presumably (hopefully) some other common, multi-process network daemons have been refactored to exec child processes. As explained in the paper, nginx, which utilizes an M:N process model, was susceptible. Anybody know if nginx was refactored to fork+exec its worker processes rather than just fork? (EDIT: AFAICT via a cursory examination of ngx_master_process_cycle, ngx_start_worker_processes, and related the answer is, "no".) EDIT: See also https://lwn.net/Articles/849531/ https://lwn.net/Articles/849531/