From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS31976 209.132.180.0/23 X-Spam-Status: No, score=-2.9 required=3.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_GMAIL_RCVD, FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS shortcircuit=no autolearn=no autolearn_force=no version=3.4.2 Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dcvr.yhbt.net (Postfix) with ESMTPS id D1B6A1F463 for ; Mon, 25 Nov 2019 16:43:46 +0000 (UTC) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-type; q=dns; s=default; b=MiQF QVzD6XuDP2ykz8YfV+b2VaIYvyYcRkiMBICD4D75Eppt2jQMjJX0SLMUXu84PnnL 90zyzkUujkZOGiqpA2bHi8T2ZehftA100Xkm7E0+fZdVPo1Byr0IbvR/hvo0y3+o Tv+CXSJz5/+TPOCUL/+PSO+wOR6m+ljWFX35yv8= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-type; s=default; bh=K8Jm1HkKEb 3cGAL6tn7UMprQtt8=; b=oHNa9oqYqPWis8HUCIsFqf0Q4xRhup1tJjFQRV6ff3 nkJtCU/A3uLx8dClVyoJ+7bk8rQAMKv+kwc3A3Em1bl0TbfvgTlvlwvgCKkDZ1Ep G7B5ZEJHPwqe1A36DfdKzYiHvJyhXAp8PeFWKL47+ZdE46P+JKF0uun2xYQ3VZEH s= Received: (qmail 96016 invoked by alias); 25 Nov 2019 16:43:44 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Received: (qmail 96008 invoked by uid 89); 25 Nov 2019 16:43:44 -0000 Authentication-Results: sourceware.org; auth=none X-HELO: mail-qt1-f179.google.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=oJ/hBzhKzDNS44Fc5HDNSp/3DBOzeBEnY89j9IOFvUs=; b=pfMLbOS55KuhvdiDT123L9eePuoEFHlqufqY5Ja8/+GFDsI9zJYX2jRVdPYlLGCOMO 96teLcI1E+8E1WidhJTgkOjhSt8OW701dpacAgqIgw2p/v/W7pd5SVDcD4NzeLx1fwQT nOM5mD5RrKbK4rLn1+yxK00O7XQryyqMjOCYcux5XIxUTfWwLStfcLxf2EaRvcYsn6c1 tK4margGGdd6nQECBSLhqso1d2vZ5eRch1cZn/f42k2qa2AJGVqVkbTZABB5iXWhDAH9 Id+BtM0Klbzit9ILatUkcyyhW7K3VsmAnspawEto+msPBzCFR/I3RNykl3RPfYSyJ9tI lAlA== MIME-Version: 1.0 References: <878sovvnef.fsf@oldenburg2.str.redhat.com> In-Reply-To: From: Vinay Kumar Date: Mon, 25 Nov 2019 22:13:29 +0530 Message-ID: Subject: Re: Thread stack and heap caches - CVE-2019-1010024 To: Florian Weimer Cc: libc-alpha@sourceware.org, carlos@redhat.com Content-Type: text/plain; charset="UTF-8" Hi Florian, Could you please review the last post on randomization. Bugzilla link : https://sourceware.org/bugzilla/show_bug.cgi?id=22852 Thanks and Regards, Vinay On Mon, Nov 11, 2019 at 4:26 PM Vinay Kumar wrote: > > Hi Florian, > > >> Does this really change the randomization? Won't the kernel map the new > >> stack at a predictable address, too? > > Yes, every time new address is assigned as shown in the below > iterations of output. > Also the attached patch "aslr_glibc.patch" adds glibc configuration > option "--with-aslr" to enable randomization. > > Compilation command: > $x86_64-windriver-linux-gcc test.c -g -fpie -pie -Xlinker > -rpath=/home/x86_64-tc/prefix-aslr//x86_64-windriver-linux/lib > -Xlinker -I /home > /x86_64-tc/prefix-aslr/x86_64-windriver-linux/lib/ld-2.30.9000.so -w > -lpthread -o thread.out > > Output: > > Trial 1: > ./thread.out > addr: 0x7f15252bfee0 > value deadbeef > malloced 0x7f1520000f70 > addr: 0x7f1524abeee0 > value 0 > malloced 0x7f1520000f70 > > Trial 2: > ./thread.out > addr: 0x7f9091640ee0 > value deadbeef > malloced 0x7f908c000f70 > addr: 0x7f9090e3fee0 > value 0 > malloced 0x7f908c000f70 > > Trial 3: > ./thread.out > addr: 0x7f0d923dfee0 > value deadbeef > malloced 0x7f0d8c000f70 > addr: 0x7f0d91bdeee0 > value 0 > malloced 0x7f0d8c000f70 > > Trial 4: > ./thread.out > addr: 0x7f146d97dee0 > value deadbeef > malloced 0x7f1468000f70 > addr: 0x7f146d17cee0 > value 0 > malloced 0x7f1468000f70 > > Regards, > Vinay