all things security

Packet Storm Advisory 2014-1204-1 - Offset2lib: Bypassing Full ASLR On 64bit Linux

Packet Storm Advisory 2014-1204-1 - Offset2lib: Bypassing Full ASLR On 64bit Linux
Posted Dec 5, 2014
Authored by Hector Marco, Ismael Ripoll | Site packetstormsecurity.com

The release of this advisory provides exploitation details in relation a weakness in the Linux ASLR implementation. The problem appears when the executable is PIE compiled and it has an address leak belonging to the executable. These details were obtained through the Packet Storm Bug Bounty program and are being released to the community.

tags | advisory, bug bounty, packet storm
systems | linux
MD5 | a5d4f2cb712163a7ebbd72e95f1856ec

Packet Storm Advisory 2014-1204-1 - Offset2lib: Bypassing Full ASLR On 64bit Linux

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

+------------------------------------------------------------------------------+
| Packet Storm Advisory 2014-1204-1 |
| http://packetstormsecurity.com/ |
+------------------------------------------------------------------------------+
| Title: Offset2lib: Bypassing Full ASLR On 64bit Linux |
+--------------------+---------------------------------------------------------+
| Release Date | 2014/12/04 |
| Advisory Contact | Packet Storm (advisories@packetstormsecurity.com) |
| Researchers | Hector Marco and Ismael Ripoll |
+--------------------+---------------------------------------------------------+
| System Affected | 64 bit PIE Linux |
| Classification | 1-day |
+--------------------+---------------------------------------------------------+

+----------+
| OVERVIEW |
+----------+

The release of this advisory provides exploitation details in relation
a weakness in the Linux ASLR implementation. The problem appears when
the executable is PIE compiled and it has an address leak belonging to
the executable.

These details were obtained through the Packet Storm Bug Bounty program
and are being released to the community.

+------------------------------------------------------------------------------+

+---------+
| DETAILS |
+---------+

An attacker is able to de-randomize all mmapped areas (libraries, mapped files, etc.)
by knowing only an address belonging to the application and the offset2lib value.

+------------------------------------------------------------------------------+

+------------------+
| PROOF OF CONCEPT |
+------------------+

The proof of concept exploit code is available here:
http://packetstormsecurity.com/files/129398

+------------------------------------------------------------------------------+

+---------------+
| RELATED LINKS |
+---------------+

http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html

+------------------------------------------------------------------------------+


+----------------+
| SHAMELESS PLUG |
+----------------+

The Packet Storm Bug Bounty program gives researchers the ability to profit
from their discoveries. You can get paid thousands of dollars for one day
and zero day exploits. Get involved by contacting us at
getpaid@packetstormsecurity.com or visit the bug bounty page at:

http://packetstormsecurity.com/bugbounty/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAlSBA04ACgkQrM7A8W0gTbG0jwCdH5CHOIDO9ELRcrPhQmf5FF4z
TgQAn2zuwadnWdMueC8gUQPT5gCmrQyp
=iegV
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    5 Files
  • 2
    Sep 2nd
    5 Files
  • 3
    Sep 3rd
    3 Files
  • 4
    Sep 4th
    13 Files
  • 5
    Sep 5th
    16 Files
  • 6
    Sep 6th
    15 Files
  • 7
    Sep 7th
    20 Files
  • 8
    Sep 8th
    16 Files
  • 9
    Sep 9th
    4 Files
  • 10
    Sep 10th
    2 Files
  • 11
    Sep 11th
    15 Files
  • 12
    Sep 12th
    19 Files
  • 13
    Sep 13th
    20 Files
  • 14
    Sep 14th
    38 Files
  • 15
    Sep 15th
    31 Files
  • 16
    Sep 16th
    1 Files
  • 17
    Sep 17th
    7 Files
  • 18
    Sep 18th
    15 Files
  • 19
    Sep 19th
    40 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close