No (K)ASLR
- Dominant language
- Rust
- Stars
- 1.5k
- Forks
- 132
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 39
Description
RustyHermit does not implement any kind of (kernel) address space layout randomization.
This has the effect that an attacker who is able to overwrite the return address in a vulnerable application can simply replace it by a target address of her choice without needing another vulnerability to leak the memory layout.
To test whether RustyHermit [randomizes the memory layout](https://en.wikipedia.org/wiki/Stack_buffer_overflow#Randomization), a simple test program was developed allocating variables in the data, heap and stack segment as well as defining a function which is placed in the code segment.
When the code is executed, the addresses of the allocated variables and the function are printed.
```Rust
fn main() {
println!("===static data===");
static MOSTLY :&str = "harmless";
println!("MOSTLY: {} at {:p}", MOSTLY, MOSTLY as *const str);
println!("===heap===");
let so_long = String::from("and thanks for all the fish!");
println!("so_long: {} at {:p}", so_long, &so_long as *const String);
println!("===text===");
println!("build_hyperspace_route() at {:p}", build_hyperspace_route as *const ());
println!("===stack===");
let answer :i32 = 42;
println!("answer: {} at {:p}", answer, &answer as *const i32);
}
fn build_hyperspace_route() {
return
}
```
When re-compiling and executing the test code multiple times, it always prints the same addresses, indicating no randomization is implemented.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.