AMD Bulldozer Linux ASLR weakness: Reducing entropy by 87.5%

A security issue in Linux ASLR implementation which affects some AMD proc=
essors=20
has been found. The issue affects to all Linux process even if they are n=
ot=20
using shared libraries (statically compiled).

The problem appears because some mmapped objects (VDSO, libraries, etc.) =
are=20
poorly randomized in an attempt to avoid cache aliasing penalties for AMD=
=20
Bulldozer (Family 15h) processors.

Affected systems have reduced the mmapped files entropy by eight. Grsecur=
ity/PaX=20
is also affected.

The total entropy for the VVAR/VDSO, mmapped files and libraries of a pro=
cesses=20
are reduced by eight. The number of possible locations where the mapped a=
reas=20
can be placed are reduced by 87.5%.

On 32-bit systems, for example, the entropy for libraries is reduced from=
 2^8 to=20
2^5, which means that libraries only have 32 different places where they =
can be=20
loaded. Under this scenario, advanced techniques used by PaX to thwart br=
ute=20
force attacks (for example, force a delay on the process creation when a =
crash=20
occurs) are no longer effective. The attackers need on average only 16 tr=
ials.

Advisory details at:
http://hmarco.org/bugs/AMD-Bulldozer-linux-ASLR-weakness-reducing-mmaped-=
files-by-eight.html


We sent a patch, and Linux 4.1 Will Improve AMD Bulldozer's ASLR Entropy =
Issue:
http://www.spinics.net/lists/linux-tip-commits/msg27373.html



--=20
Hector Marco-Gisbert @ http://hmarco.org/
Cyber Security Researcher @ http://cybersecurity.upv.es
Universitat Polit=C3=A8cnica de Val=C3=A8ncia (Spain)