Exploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit Systems
summary
Four implementation flaws are measured and exploited: too low entropy (executable often only ~15–28 bits), non‑uniform distributions (triangular sums reduce effective bits), correlation between objects (libraries loaded side‑by‑side so leaking one reveals others) and inheritance across forked children. A sampler/analyzer tool ASLRA computes entropy and correlations, and a proof‑of‑concept exploit guesses 3 partial bytes with ~768 attempts and bypasses Full ASLR in <1s on a 64‑bit Linux; ASLR‑NG redesign and kernel patches are provided.
AI-written summary · about
chapters (10)
- 0:00Introduction to ASLR
- 1:07ASLR background and concepts
- 5:07Known ASLR weaknesses
- 8:14Distribution and entropy issues
- 10:45Correlation and inheritance
- 16:20Analysis tool demonstration
- 23:02Offset-to-lib attack demo
- 35:59ASLR Next Generation design
- 46:03Conclusion and results
- 50:58Q&A session
related talks
45mAbusing Performance Optimization Weaknesses to Bypass ASLR
53mSilently Breaking ASLR In The Cloud
35mOn Securing Legacy Software Against Code-Reuse Attacks
54mAnalyzing & Breaking QNX Exploit Mitigations and PRNGs For Embedded Systems
51mThe Anatomy of an Exploit
57mreturn-to-csu: A New Method to Bypass 64-bit Linux ASLR
41mUsing Microarchitectural Design to Break KASLR and More
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation