5 ms·
ASLR: enabled by default on virtually all Linux systems, can be improved with the installation of PaX. disabled by default on Windows systems. KASLR: Windows h
by Hello71 12y ago
ASLR: enabled by default on virtually all Linux systems, can be improved with the installation of PaX. disabled by default on Windows systems.
KASLR: Windows has it, Linux does too, but only since 3.14.
SSP: libc specific, but MSVS since 2003 has basic stack-smashing support similar to gcc's -fstack-protector which has been enabled in Debian-based distros for many years, and is now being improved over MSVC /GS with -fstack-protector-strong.
NX bit support: Support added around 2004 or XP. Again, PaX is far stronger than Windows here.
"Guard pages": This is SSP with a different name.
So at best, we can say that Windows added some security features slightly earlier, but has lagged in updating them to new standards.
- robryk 12y agoI've thought that guard pages referred to the practice of having a page or a couple allocated before and after an accessible region and set to PROT_NONE (any access causes a trap) to prevent any new allocation from making those pages accessible. This way reads/writes at most a page past the beginning/end of our allocation will always fault. I don't see how is this "SSP with a different name" (the goals are similar but the method is very different). Did you mean some other kind of guard pages or am I missing something?
- Ded7xSEoPKYNsDd 12y agoFull ASLR on Linux requires compiling with non-standard options (-pie -fPIE). Linux distributions seem to do this only on a case by case basis. They should've enabled these flags for most at-risk software by now, but I'm not convinced they got to all of them.