Not the best solution
Not the best solution
Posted Feb 3, 2005 5:42 UTC (Thu) by Ross (guest, #4065)Parent article: Address space randomization in 2.6
Stack protection and/or canaries are better solutions. They offer stronger
protection (canaries can be a full 32 bits, and stack protection can prevent
overflows no matter how many guesses an attacker gets). Randomization of
addresses are unfortunate because they make programs non-deterministic.
One of the nice things about a virtualized environment with address
separation is that running the same program will produce the same results
sans device I/O or wall-clock timings. That said it can be useful as an
additional layer... it just should not be something which we depend on for
security.
The LWN site is currently under high scraper load, so comment display has been suppressed for anonymous users. If you are a human, you may read the comments by clicking the button below:
Note: you can avoid this step in the future by logging into your LWN account.