Is pre-linking worth it? [LWN.net]

Is pre-linking worth it?

Posted Jul 15, 2009 21:53 UTC (Wed) by jake (editor, #205)
In reply to: Is pre-linking worth it? by nix
Parent article: Is pre-linking worth it?

> On 64-bit boxes, of course, there are pretty much no security implications
> of prelinking: even if ASLR *is* statically determined when prelink is
> active, the address space is large enough that an attacker has little
> chance of success anyway.

Hmm, the security problems with pre-linking don't center around brute-forcing library addresses, I don't think. Instead, if an attacker can run a program and see where libc (for example) ends up in their memory map, they can be pretty sure it will be in the same place for other targets of interest. For up to two weeks.

jake

to post comments

Is pre-linking worth it?

Posted Jul 15, 2009 23:12 UTC (Wed) by nix (subscriber, #2304) [Link] (2 responses)

A *local* attacker? If a hostile attacker has got onto your system and can
observe /proc/self/maps for security-critical programs (say, those running
as root) you have already lost, ASLR or no ASLR. If you are concerned
about hostile users, chmod such programs so that only root can execute
them, or explicitly 'prelink --undo' them to re-enable ASLR for those
programs.

I was talking about ASLR's role in stopping them from getting on in the
first place, when they have to use 'did {this part of} the exploit work?'
as an oracle.

Is pre-linking worth it?

Posted Jul 15, 2009 23:25 UTC (Wed) by jake (editor, #205) [Link] (1 responses)

> A *local* attacker? If a hostile attacker has got onto your system and can
> observe /proc/self/maps for security-critical programs

I think we are talking across each other. If an attacker can do 'cat /proc/self/maps', and thus see the memory map of 'cat', they will see where libc is mapped. On a pre-linked system, that is the likely place it is mapped for *other* interesting programs. So, a local attacker, or one who can get map information for simple, non-security-critical programs, can then use that information in a buffer overflow or other exploit of the security-critical program of interest (assuming it links to libc).

*that* is a security hole for pre-linking ...

(btw, your email notifications are bouncing :)

jake

Is pre-linking worth it?

Posted Jul 16, 2009 0:36 UTC (Thu) by nix (subscriber, #2304) [Link]

Agreed: prelink is problematic iff you have hostile local users, but if
you avoid prelinking privileged programs, libc will be mapped elsewhere
for those programs.

(Sorry about the bounces: my ISP, Zetnet, has gone insane, changing my
static IP but failing to tell me the new IP address ahead of time, failing
to update my DNS zone even when specifically requested, so all its RRs
still point to the old address, messing up the MX relay so that all
incoming email, even to their own DNS administrator, gets bounced rather
than queued, and failing to give me a MAC code (horrid UK-specific
broadband techspeak) as they are legally obliged to, so I can't even
switch to a new ISP. It's absolutely crazy, and I can do nothing
whatsoever about it. God knows what email I've lost.

To make this Linux-relevant, let this be a lesson to everyone in the
dangers of making Debian developers redundant, especially when they know
the network from top to bottom and you're just about to carry out major
changes to that network. In fact it's better never to make Debian
developers redundant at all. Actually it's best if you just give them lots
of money without their even needing to ask. Really.)

Is pre-linking worth it?

Posted Jul 16, 2009 6:05 UTC (Thu) by PaXTeam (guest, #24616) [Link]

ASLR was never meant to protect against local attacks, see http://lwn.net/Articles/334027/ for more explanation. the two week period is a vulnerability however for it's plenty of time to remotely brute force guess addresses (that is, when one cannot already leak addresses). that's why ASLR is really only meaningful when you can limit brute force search.