3 ms·
It does not have KASLR and it does not even have userland binaries ASLR enabled by default(not that it matters for this vulnerability). https://twitter.com/wdo
by rs_rs_rs_rs_rs 4y ago
It does not have KASLR and it does not even have userland binaries ASLR enabled by default(not that it matters for this vulnerability).
https://twitter.com/wdormann/status/1528742791383334917 https://twitter.com/wdormann/status/1528742791383334917
>It would make thus attack much harder
It won't make it much harder, just a teensy bit harder.
https://grsecurity.net/kaslr_an_exercise_in_cargo_cult_security https://grsecurity.net/kaslr_an_exercise_in_cargo_cult_secur...
- comex 4y agogrsecurity is very… opinionated. In reality, it may or may not be possible to use this vulnerability without knowing any addresses beforehand. If it’s not, then if the KASLR implementation is good enough, successful exploitation would be impossible without an extra infoleak vulnerability, which is certainly nontrivial to find for a remote attack like this one. (Though even when it comes to local attacks, the post somewhat exaggerates how difficult it is to prevent such vulnerabilities.) Also, in this particular case, if there are multiple vulnerable devices in the vicinity, it might be hard to ensure that your crafted beacon frame only reaches one of them and not the others. So it’s helpful if the exploit payload is fixed rather than needing to be customized per target - something which is much less likely to be possible with KASLR.
- nix23 4y ago>ASLR enabled by default True but since 13.1 you can enable it in the installation-tui (in the hardening dialog)