Issue about Address Space Layout Randomization of cisco router

[pedrib]

Issue about Address Space Layout Randomization of cisco router

[pedrib]

@Fans0n-Fan thanks for your comment.

In 32 bits Linux, especially on old kernels in non-x86 architectures, the entropy of the ASLR is very low. Typically there are only 12 bits of entropy:

PoC/advisories/dlink-hnap-login.txt

Line 156 in d374e22

The affected ARM devices have a non-executable stack (NX) and 32 bit ASLR. NX can be defeated with ROP, and the 32 bit ASLR is weak - there are only 3 bytes that change in the address calculations, which means there are only 4096 possible values. The attack has to be run several times until the correct base address is hit, but this can usually be achieved in less than 1000 attempts.

But actually on this target ASLR is on and it does work properly!

Here something weird is going on.. the daemon (sslvpn) spawns multiple threads, and one of the threads always has the stack at the same location. But the stack of the other threads, and all other libraries are, heap, etc, are all properly randomised ("properly" - bearing in mind the low entropy I mentioned above).

No idea why this is the case, I have never seen this behaviour before.

[pedrib]

We've just updated the advisory with a bit more knowledge about the bug, as we studied it a bit further. We still don't know why such light randomisation is used, but we know more or less what is happening. Please re-read that part! Closing this for now.