Re: Randomize offset between program segments?

[Siddhesh Poyarekar <siddhesh@gotplt.org>]

On 10/21/20 4:14 PM, Topi Miettinen wrote:
>> The alternative (which is what PIC does for global variables) is to have
>> a GOT-like indirection, where instead of the single pc-relative load,
>> the compiler emits a load from that table and a subsequent load from the
>> address in GOT.  Here, patching by the dynamic linker is safe since the
>> offset table is rw, but you will have doubled the number of instructions
>> needed to access your data.
> 
> Also size of GOT will increase. Otherwise this seems a better approach.

You shouldn't use GOT (because it's the *global* offset table) but a
similar idea.  A rose by another name...

> I don't know. What would be the method to quantify such benefits? This
> applies to a specific case where the attacker is able to determine an
> address in one segment but needs to find an address in another segment
> in order to win, and without ASLR the offset between the addresses would

First build evidence for this possibility, i.e. how easy is it to
determine the address of one segment in a binary and how much
*incremental* effort does it take to determine the address of other
segments?

> be always known by the attacker (for example, because the distro and the
> version for the program or library is known). Without ASLR, chance of
> winning is 100%. With ASLR, this could be related to number of bits in
> randomization. In the 32 bit offset case this would be 20 bits (assuming
> 12 bits page size), so the chances of guessing would be 2^-20 and brute
> forcing the offset would be expected to take 2^20/2 attempts.

Question is, would it really be an additional 2^20 tries at all times?
For example, the offset table has to be at a known offset from the code
and hence could be computed once you know the address of the code
segment.  From there, the final address for the data access is just an
indirection away.

Siddhesh