[Bug libc/23323] New: [RFE] CSU startup hardening.

[wmealing at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23323

            Bug ID: 23323
           Summary: [RFE] CSU startup hardening.
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: wmealing at redhat dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Gday!

I've been made aware of an ASLR mitigation technique known as "return to CSU". 
It builds on the existing idea of ROP gadgets, but instead uses the internal
widgets available in __libc_csu_init().

This attack technique is not an exploit in itself but rather removing ROP
widgets from predictable locations.   Rather than waste more time, check out
the information here, along with suggestions for mitigations/ideas to remove
these enabling widgets.

https://www.blackhat.com/docs/asia-18/asia-18-Marco-return-to-csu-a-new-method-to-bypass-the-64-bit-Linux-ASLR-wp.pdf

https://www.blackhat.com/docs/asia-18/asia-18-Marco-return-to-csu-a-new-method-to-bypass-the-64-bit-Linux-ASLR.pdf

So what I want out of this, I hear you ask.  I defer to the experts on where to
go from here, as this is not the area that I would know if any of these
mitigations / plans have adverse affects.

It may be possible that the authors have already talked to the glibc
maintainers, I did a quick search and wasn't able to find it.

Thanks in advance.

Wade Mealing

-- 
You are receiving this mail because:
You are on the CC list for the bug.