full-disclosure - Re: [FD] AMD Bulldozer Linux ASLR weakness: Reducing entropy by 87.5%

Open Source and information security mailing list archives

Date: Thu, 07 May 2015 16:48:46 +0200
From: Hector Marco-Gisbert <hecmargi@....es>
To: fulldisclosure@...lists.org, full-disclosure@...ts.grok.org.uk,
	bugtraq@...urityfocus.com
Cc: Ismael Ripoll <iripoll@...ca.upv.es>,
	Assign a CVE Identifier <cve-assign@...re.org>
Subject: Re: [FD] AMD Bulldozer Linux ASLR weakness: Reducing entropy by
	87.5%

Hi,

PaX solution has actually 16 random bits for mmap objects in 32bit systems on 
non affected systems. On affected systems the random bits are degraded to 2^13.
Unfortunately, depending on the PaX Kernel configuration sequence, some features
may not be enabled. There are sequences of PaX configuration which does not give
the expected result.

The configuration sequence that results in a miss-configured system is:

     1.- Starting from a clean Linux tree with PaX patch applied.

     2.- Enabled the "Grsecurity" option (which sets "Security Method" to
"Custom") and compile&test:
     Observed mmap entropy: 2^5 (as expected).

     3.- Then set "Security Method" to "Automatic" (which sets "Required 
Priorities" to "Performance") and compile&test:
     Observed mmap entropy: 2^5.

     4.- Last test: select "Security" on the "Required Priorities" option and
compile&test:
     Observed mmap entropy: 2^5.

     5.- At this point, it seems that the "Required Priorities" option has no
effect, that is, switching from "Performance" to "Security" or the other way
around (as may times as desired) does not enable/disable the expected features,
including the mmap randomization.

If steps 2 and 3, or 2 and 4 are configured at once (without exiting from the
menuconfig), then the system gets properly configured.

It seems that something in the PaX Kconfig files are not properly done. Could 
anyone check it ? So, if you are using PaX, it worth to ensure that you are not 
losing any PaX feature.

-- 
Hector Marco-Gisbert @ http://hmarco.org/
Cyber Security Researcher @ http://cybersecurity.upv.es
Universitat Politècnica de València (Spain)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives