4 ms·
The presented vulnerabilities is so easy to exploit mostly because distros do not compile `su` with PIE and lose the ability to hide memory addresses with ASLR.
by gioele 15y ago
The presented vulnerabilities is so easy to exploit mostly because distros do not compile `su` with PIE and lose the ability to hide memory addresses with ASLR. Just few days ago there has been a discussion about how PIC/PIE is only a performance loss and should not be present in modern Unix systems.
[1] https://news.ycombinator.com/item?id=3472618 https://news.ycombinator.com/item?id=3472618
[2] https://news.ycombinator.com/item?id=3473068 https://news.ycombinator.com/item?id=3473068
- foobarbazetc 15y ago"because distros do not compile `su` with PIE" Really? Every single distro I've tested has su compiled with PIE.
- gioele 15y agoFrom the article: > It turns out that su on the vast majority of distros is not compiled with PIE, disabling ASLR for the .text section of the binary! I tested on Ubuntu 10.04 LTS, likely to be installed on many servers, and 11.04. On these two versions `su` has not been compiled with PIE. Edit: just to make things clear: in these Ubuntu versions su is compiled without PIE, but are not vulnerable because they have kernels < 2.6.39.
- mikeash 15y agoHow long would it take to brute-force ASLR for this exploit, given that execution is under control of the exploiter, and can thus be tried many times in quick succession? I recall that some OSes only have a small number of different ASLR permutations, but I don't know the details, and especially not the details of Linux's implementation.
- rzhou 15y agoOn 32-bit systems, it's feasible to brute force, as there are only about 12 bits of entropy. There are a lot more random bits on 64-bit systems, so I don't consider it brute force to be that practical there.