Re: ASLRn't is still alive and well on x86 kernels, despite CVE-2024-26621 patch

[Will Dormann <will.dormann () analygence com>]

On 7/10/24 4:54 PM, Yves-Alexis Perez wrote:
> On Mon, 2024-07-08 at 12:37 -0400, Will Dormann wrote:
> >    - Modern (e.g. 6.x kernel) x86 platforms load a large-enough libc at
> > the same address every time. (i.e. no practical ASLR -- "ASLRn't")
> >    -  Modern (e.g. 6.x kernel and large-enough libc) x86_64 platforms
> > running 32-bit code will load a large-enough library at the same address
> > every time.
> >    - Modern x86_64 systems with the CVE-2024-26621 patch will randomize
> > the load address of large libraries loaded by 32-bit apps.
> >    - Modern x86 systems with the CVE-2024-26621 patch will NOT ranzomize
> > the load address of large libraries.  (i.e. is still vulnerable to
> > "ASLRn't" despite the patch)
>
> Hey,
>
> I'm testing on my Debian sid laptop with Linux kernel 6.9.7-1. This is amd64
> but running test-mmap built with -m32, and I get:
>
> for i in {0..10}; do ./test-mmap < zeros; done
> mmap(NULL, 2097152, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 0, 0) = 0xf7df3000
> mmap(NULL, 2097152, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 0, 0) = 0xf7d98000
> mmap(NULL, 2097152, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 0, 0) = 0xf7d6f000



Linux 6.9.7 was released in June2024, and the patches for CVE-2024-26621 
went in months before that.  This behavior matches my 3rd bullet point 
above, so I think everything is as expected here.  ("... will randomize 
the load address of large libraries loaded by 32-bit apps.")

If you want to see the lack of randomization, try the test with an x86 
kernel, not amd64.



-WD