linux-kernel - Re: [PATCH 3/3] x86: kernel base offset ASLR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130405075532.GF26889@gmail.com>
Date:	Fri, 5 Apr 2013 09:55:32 +0200
From:	Ingo Molnar <mingo@...nel.org>
To:	Eric Northup <digitaleric@...gle.com>
Cc:	"H. Peter Anvin" <hpa@...or.com>,
	Kees Cook <keescook@...omium.org>,
	LKML <linux-kernel@...r.kernel.org>,
	"kernel-hardening@...ts.openwall.com" 
	<kernel-hardening@...ts.openwall.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"x86@...nel.org" <x86@...nel.org>,
	Jarkko Sakkinen <jarkko.sakkinen@...el.com>,
	Matthew Garrett <mjg@...hat.com>,
	Matt Fleming <matt.fleming@...el.com>,
	Dan Rosenberg <drosenberg@...curity.com>,
	Julien Tinnes <jln@...gle.com>, Will Drewry <wad@...omium.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 3/3] x86: kernel base offset ASLR

* Eric Northup <digitaleric@...gle.com> wrote:

> On Thu, Apr 4, 2013 at 1:58 PM, H. Peter Anvin <hpa@...or.com> wrote:
> > It seems to me that you are assuming that the attacker is targeting a specific system, but a bot might as well target 256 different systems and see what sticks...
> 
> The alarm signal from the ones that don't stick is, in my opinion, the 
> primary benefit from this work -- it makes certain classes of attack 
> much less economical.  A crash dump from a panic'd machine may include 
> enough information to diagnose the exploited vulnerability - and once 
> diagnosed and fixed, knowledge about the vulnerability is much less 
> valuable.

Correct.

Beyond making worm propagation and zombie collection dynamics much less 
favorable, there's another aspect to randomization: attacks against high 
value Linux targets often use high value exploits, where considerable 
effort is spent to make sure that the attack will succeed 100%, without 
alerting anyone - or will fail safely without alerting anyone.

Probabilistically crashing the kernel does not fit that requirement.

In some cases adding even a _single bit_ of randomness will change the 
economics dramatically, because as time progresses and the kernel gets 
(hopefully) more secure, the value of an exploitable zero-day 
vulnerability becomes inevitably much higher than the value of pretty much 
any system attacked.

Injecting a significant risk of detection is a powerful concept. Think of 
WWII: how much effort went into making sure that the Germans did not 
detect that the encryption of Enigma was broken. Or how much effort went 
into making sure that the soviets did not detect that the US got hold of 
one of their nukes - etc.

So this feature really seems useful across the security spectrum, for low 
and high value systems alike.

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/