Offset2lib: Bypassing Full ASLR On 64bit Linux

vendor:

N/A

by:

Hector Marco and Ismael Ripoll

7,2

CVSS

HIGH

Offset2lib

N/A

CWE

Product Name: N/A

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: No

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2014

Offset2lib: Bypassing Full ASLR On 64bit Linux

Offset2lib is a vulnerability in the Linux ASLR implementation that allows an attacker to de-randomize all mmapped areas (libraries, mapped files, etc.) by knowing only an address belonging to the application and the offset2lib value.

Mitigation:

The vulnerability can be mitigated by disabling PIE support.

Source

Exploit-DB raw data:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

+------------------------------------------------------------------------------+
| Packet Storm Advisory 2014-1204-1                                            |
| http://packetstormsecurity.com/                                              |
+------------------------------------------------------------------------------+
| Title: Offset2lib: Bypassing Full ASLR On 64bit Linux                        |
+--------------------+---------------------------------------------------------+
| Release Date       | 2014/12/04                                              |
| Advisory Contact   | Packet Storm (advisories@packetstormsecurity.com)       |
| Researchers        | Hector Marco and Ismael Ripoll                          |
+--------------------+---------------------------------------------------------+
| System Affected    | 64 bit PIE Linux                                        |
| Classification     | 1-day                                                   |
+--------------------+---------------------------------------------------------+

+----------+
| OVERVIEW |
+----------+

The release of this advisory provides exploitation details in relation 
a weakness in the Linux ASLR implementation.  The problem appears when 
the executable is PIE compiled and it has an address leak belonging to 
the executable.

These details were obtained through the Packet Storm Bug Bounty program 
and are being released to the community.

+------------------------------------------------------------------------------+

+---------+
| DETAILS |
+---------+

An attacker is able to de-randomize all mmapped areas (libraries, mapped files, etc.) 
by knowing only an address belonging to the application and the offset2lib value.

+------------------------------------------------------------------------------+

+------------------+
| PROOF OF CONCEPT |
+------------------+

The proof of concept exploit code is available here:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35472.tgz
http://packetstormsecurity.com/files/129398

+------------------------------------------------------------------------------+

+---------------+
| RELATED LINKS |
+---------------+

http://cybersecurity.upv.es/attacks/offset2lib/offset2lib.html

+------------------------------------------------------------------------------+


+----------------+
| SHAMELESS PLUG |
+----------------+

The Packet Storm Bug Bounty program gives researchers the ability to profit 
from their discoveries.  You can get paid thousands of dollars for one day 
and zero day exploits.  Get involved by contacting us at 
getpaid@packetstormsecurity.com or visit the bug bounty page at: 

http://packetstormsecurity.com/bugbounty/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAlSBA04ACgkQrM7A8W0gTbG0jwCdH5CHOIDO9ELRcrPhQmf5FF4z
TgQAn2zuwadnWdMueC8gUQPT5gCmrQyp
=iegV
-----END PGP SIGNATURE-----