On the effectiveness of address-space randomization

Address-space randomization is a technique used to fortify systems against buer over ow attacks. The idea is to introduce articial diversity by randomizing the memory location of certain system components. This mechanism is available for both Linux (via PaX ASLR) and OpenBSD. We study the eectiveness of address-space randomization and nd that its utility on 32-bit architectures is limited by the number of bits available for address randomization. In particular, we demonstrate a derandomization attack that will convert any standard buer-over ow exploit into an exploit that works against systems protected by address-space randomization. The resulting exploit is as eective as the original exploit, although it takes a little longer to compromise a target machine: on average 216 seconds to compromise Apache running on a Linux PaX ASLR system. The attack does not require running code on the stack. We also explore various ways of strengthening addressspace randomization and point out w...

• Type: Conference
• Year: 2004
• Where: CCS
• Authors: Hovav Shacham, Matthew Page, Ben Pfaff, Eu-Jin Goh, Nagendra Modadugu, Dan Boneh
• Keywords: Address Randomization, Address-space Randomization, CCS 2004, PaX ASLR, Security Privacy