hermit-os / hermit-os/kernel

No (K)ASLR

Open
#338 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
1.5k
Forks
132
Avg merge
1d 14h
Merged PRs (30d)
39

Description

RustyHermit does not implement any kind of (kernel) address space layout randomization.
This has the effect that an attacker who is able to overwrite the return address in a vulnerable application can simply replace it by a target address of her choice without needing another vulnerability to leak the memory layout.

To test whether RustyHermit [randomizes the memory layout](https://en.wikipedia.org/wiki/Stack_buffer_overflow#Randomization), a simple test program was developed allocating variables in the data, heap and stack segment as well as defining a function which is placed in the code segment.
When the code is executed, the addresses of the allocated variables and the function are printed.

```Rust
fn main() {
println!("===static data===");
static MOSTLY :&str = "harmless";
println!("MOSTLY: {} at {:p}", MOSTLY, MOSTLY as *const str);

println!("===heap===");
let so_long = String::from("and thanks for all the fish!");
println!("so_long: {} at {:p}", so_long, &so_long as *const String);

println!("===text===");
println!("build_hyperspace_route() at {:p}", build_hyperspace_route as *const ());

println!("===stack===");
let answer :i32 = 42;
println!("answer: {} at {:p}", answer, &answer as *const i32);
}

fn build_hyperspace_route() {
return
}
```

When re-compiling and executing the test code multiple times, it always prints the same addresses, indicating no randomization is implemented.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.