Re: Thread stack and heap caches - CVE-2019-1010024

[Vinay Kumar <vinay.m.engg@gmail.com>]

Hi Florian,

Could you please review the last post on randomization.
Bugzilla link : https://sourceware.org/bugzilla/show_bug.cgi?id=22852

Thanks and Regards,
Vinay



On Mon, Nov 11, 2019 at 4:26 PM Vinay Kumar <vinay.m.engg@gmail.com> wrote:
>
> Hi Florian,
>
> >> Does this really change the randomization?  Won't the kernel map the new
> >> stack at a predictable address, too?
>
> Yes, every time new address is assigned as shown in the below
> iterations of output.
> Also the attached patch "aslr_glibc.patch" adds glibc configuration
> option "--with-aslr" to enable randomization.
>
> Compilation command:
> $x86_64-windriver-linux-gcc test.c -g -fpie -pie -Xlinker
> -rpath=/home/x86_64-tc/prefix-aslr//x86_64-windriver-linux/lib
> -Xlinker -I /home
> /x86_64-tc/prefix-aslr/x86_64-windriver-linux/lib/ld-2.30.9000.so -w
> -lpthread -o thread.out
>
> Output:
>
> Trial 1:
> ./thread.out
> addr: 0x7f15252bfee0
> value deadbeef
> malloced 0x7f1520000f70
> addr: 0x7f1524abeee0
> value 0
> malloced 0x7f1520000f70
>
> Trial 2:
> ./thread.out
> addr: 0x7f9091640ee0
> value deadbeef
> malloced 0x7f908c000f70
> addr: 0x7f9090e3fee0
> value 0
> malloced 0x7f908c000f70
>
> Trial 3:
> ./thread.out
> addr: 0x7f0d923dfee0
> value deadbeef
> malloced 0x7f0d8c000f70
> addr: 0x7f0d91bdeee0
> value 0
> malloced 0x7f0d8c000f70
>
> Trial 4:
> ./thread.out
> addr: 0x7f146d97dee0
> value deadbeef
> malloced 0x7f1468000f70
> addr: 0x7f146d17cee0
> value 0
> malloced 0x7f1468000f70
>
> Regards,
> Vinay