On 7/10/24 4:54 PM, Yves-Alexis Perez wrote:
On Mon, 2024-07-08 at 12:37 -0400, Will Dormann wrote:
- Modern (e.g. 6.x kernel) x86 platforms load a large-enough libc at
the same address every time. (i.e. no practical ASLR -- "ASLRn't")
- Modern (e.g. 6.x kernel and large-enough libc) x86_64 platforms
running 32-bit code will load a large-enough library at the same address
every time.
- Modern x86_64 systems with the CVE-2024-26621 patch will randomize
the load address of large libraries loaded by 32-bit apps.
- Modern x86 systems with the CVE-2024-26621 patch will NOT ranzomize
the load address of large libraries. (i.e. is still vulnerable to
"ASLRn't" despite the patch)
Hey,
I'm testing on my Debian sid laptop with Linux kernel 6.9.7-1. This is amd64
but running test-mmap built with -m32, and I get:
for i in {0..10}; do ./test-mmap < zeros; done
mmap(NULL, 2097152, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 0, 0) = 0xf7df3000
mmap(NULL, 2097152, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 0, 0) = 0xf7d98000
mmap(NULL, 2097152, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 0, 0) = 0xf7d6f000
Linux 6.9.7 was released in June2024, and the patches for CVE-2024-26621
went in months before that. This behavior matches my 3rd bullet point
above, so I think everything is as expected here. ("... will randomize
the load address of large libraries loaded by 32-bit apps.")
If you want to see the lack of randomization, try the test with an x86
kernel, not amd64.
-WD
