Effectiveness

Address space layout randomization is based upon the low chance of an attacker guessing the locations of randomly placed areas. Security is increased by increasing the search space. Thus, address space randomization is more effective when more entropy is present in the random offsets. Entropy is increased by either raising the amount of virtual memory area space over which the randomization occurs or reducing the period over which the randomization occurs. The period is typically implemented as small as possible, so most systems must increase VMA space randomization.

To defeat the randomization, attackers must successfully guess the positions of all areas they wish to attack. For data areas such as stack and heap, where custom code or useful data can be loaded, more than one state can be attacked by using NOP slides for code or repeated copies of data. This allows an attack to succeed if the area is randomized to one of a handful of values. In contrast, code areas such as library base and main executable need to be discovered exactly. Often these areas are mixed, for example stack frames are injected onto the stack and a library is returned into.

The following variables can be declared:

• ${\displaystyle E_{s}}$ (entropy bits of stack top)
• ${\displaystyle E_{m}}$ (entropy bits of mmap() base)
• ${\displaystyle E_{x}}$ (entropy bits of main executable base)
• ${\displaystyle E_{h}}$ (entropy bits of heap base)
• ${\displaystyle A_{s}}$ (attacked bits per attempt of stack entropy)
• ${\displaystyle A_{m}}$ (attacked bits per attempt of mmap() base entropy)
• ${\displaystyle A_{x}}$ (attacked bits per attempt of main executable entropy)
• ${\displaystyle A_{h}}$ (attacked bits per attempt of heap base entropy)
• ${\displaystyle \alpha }$ (attempts made)
• ${\displaystyle N}$ (total amount of entropy: ${\displaystyle N=(E_{s}-A_{s})+(E_{m}-A_{m})+(E_{x}-A_{x})+(E_{h}-A_{h})\,}$)

To calculate the probability of an attacker succeeding, a number of attempts α carried out without being interrupted by a signature-based IPS, law enforcement, or other factor must be assumed; in the case of brute forcing, the daemon cannot be restarted. The number of relevant bits and how many are being attacked in each attempt must also be calculated, leaving however many bits the attacker has to defeat.

The following formulas represent the probability of success for a given set of α attempts on N bits of entropy.

• ${\displaystyle g\left(\alpha \,\right)=1-{\left(1-{2^{-N}}\right)^{\alpha }\,}\,{\text{ if }}0\leq \,\alpha \,}$ (isolated guessing; address space is re-randomized after each attempt)
• ${\displaystyle b\left(\alpha \,\right)={\frac {\alpha \,}{2^{N}}}\,{\text{ if }}0\leq \,\alpha \,\leq \,{2^{N}}}$ (systematic brute forcing on copies of the program with the same address space)

In many systems, ${\displaystyle 2^{N}}$ can be in the thousands or millions; on modern 64-bit systems, these numbers typically reach the millions at least, Hector Marco-Gisbert and Ismael Ripoll showed in 2014 how to bypass the ASLR in 64-bit systems in less than one second under certain circumstances.^[5] For 32-bit systems at 2004 computer speeds which have 16 bits for address randomization, Shacham and co-workers state "... 16 bits of address randomization can be defeated by a brute force attack within minutes."^[6] The authors' statement depends on the ability to attack the same application multiple times without any delay. Proper implementations of ASLR, like that included in grsecurity, provide several methods to make such brute force attacks infeasible. One method involves preventing an executable from executing for a configurable amount of time if it has crashed a certain number of times.

Android,^[7] and possibly other systems, implement Library Load Order Randomization, a form of ASLR which randomizes the order in which libraries are loaded. This supplies very little entropy. An approximation of the number of bits of entropy supplied per needed library appears below; this does not yet account for varied library sizes, so the actual entropy gained is really somewhat higher. Attackers usually need only one library; the math is more complex with multiple libraries, and shown below as well. The case of an attacker using only one library is a simplification of the more complex formula for ${\displaystyle l=1}$.

• l (number of libraries loaded)
• β (number of libraries used by the attacker)
• ${\displaystyle E_{m}={\begin{cases}\log _{2}\left(l\right)&{\text{ if }}\beta \,=1,l\geq \,1\\\sum _{i=l}^{l-\left(\beta \,-1\right)}\log _{2}\left(i\right)&{\text{ if }}\beta \,\geq \,1,l\geq \,1\end{cases}}}$

These values tend to be low even for large values of l, most importantly since attackers typically can use only the C standard library and thus one can often assume that ${\displaystyle \beta \,=1}$. However, even for a small number of libraries there are a few bits of entropy gained here; it is thus potentially interesting to combine library load order randomization with VMA address randomization to gain a few extra bits of entropy. These extra bits of entropy will not apply to other mmap() segments, only libraries.

Limitations

ASLR-protected addresses can be leaked by various side channels, removing mitigation utility. Recent attacks have used information leaked by the CPU branch target predictor buffer (BTB) or memory management unit (MMU) walking page tables. It is not clear if this class of ASLR attack can be mitigated. If they cannot, the benefit of ASLR is reduced or eliminated.

Android

Android 4.0 Ice Cream Sandwich provides address space layout randomization (ASLR) to help protect system and third-party applications from exploits due to memory-management issues. Position-independent executable support was added in Android 4.1.^[9] Android 5.0 dropped non-PIE support and requires all dynamically linked binaries to be position independent.^[10][11] Library load ordering randomization was accepted into the Android open-source project on 26 October 2015,^[7] and was included in the Android 7.0 release.

DragonFly BSD

DragonFly BSD has an implementation of ASLR based upon OpenBSD's model, added in 2010.^[12] It is off by default, and can be enabled by setting the sysctl vm.randomize_mmap to 1.

FreeBSD

Support for ASLR appeared in FreeBSD 13.0.^[13][14] It is enabled by default since 13.2.^[15]

iOS (iPhone, iPod touch, iPad)

Apple introduced ASLR in iOS 4.3 (released March 2011).^[16]

KASLR was introduced in iOS 6.^[17] The randomized kernel base is 0x01000000 + ((1+0xRR) * 0x00200000), where 0xRR is a random byte from SHA1 (random data) generated by iBoot (the 2nd-stage iOS Boot Loader).^[18]

Linux

The Linux kernel enabled a weak form of ASLR by default since the kernel version 2.6.12, released in June 2005.^[19] The PaX and Exec Shield patchsets to the Linux kernel provide more complete implementations. The Exec Shield patch for Linux supplies 19 bits of stack entropy on a period of 16 bytes, and 8 bits of mmap base randomization on a period of 1 page of 4096 bytes. This places the stack base in an area 8 MB wide containing 524,288 possible positions, and the mmap base in an area 1 MB wide containing 256 possible positions.

Position-independent executable (PIE) implements a random base address for the main executable binary and has been in place since April 18, 2004. It provides the same address randomness to the main executable as being used for the shared libraries. The PIE feature cannot be used together with the prelink feature for the same executable. The prelink tool implements randomization at prelink time rather than runtime, because by design prelink aims to handle relocating libraries before the dynamic linker has to, which allows the relocation to occur once for many runs of the program. As a result, real address space randomization would defeat the purpose of prelinking.

The randomization can be disabled for a specific process by changing its execution domain, using personality(2).^[20]

The Linux kernel 5.18 released May 2022 reduced the effectiveness of both 32bit and 64bit implementations due to memory alignment, resulting in certain distributions having libc being fix-mapped for 32-bit applications and 9-bits of libc's ASLR for 64-bit applications being lost. ^[21]

On January 8, 2024, Justin Miller published a vulnerability:^[22]

So, to summarize, major filesystems call thp_get_unmapped_area, this patch makes it so regular file backed mappings that go through thp_get_unmapped_area can be backed by Huge Pages, and some libc’s have (somewhat recently) surpassed 2MB. This all converged such that on some distros libc is being fix-mapped for 32-bit applications and 9-bits of libc’s ASLR for 64-bit applications has been lost (again impact will vary across distros). I’ve been stressing libc just because it’s used by so many applications and has all the ROP gadgets anyone needs anyways, but just to be clear it’s not just libc, any library >=2MB is potentially affected, and even anonymous mappings >=2MB are being 2MB aligned on my Ubuntu 22.04 system, though I’m still not sure what that’s about…

Microsoft Windows

Microsoft's Windows Vista (released January 2007) and later have ASLR enabled only for executables and dynamic link libraries that are specifically linked to be ASLR-enabled.^[32] For compatibility, it is not enabled by default for other applications. Typically, only older software is incompatible and ASLR can be fully enabled by editing a registry entry HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages,^[33] or by installing Microsoft's Enhanced Mitigation Experience Toolkit.

The locations of the heap, stack, Process Environment Block, and Thread Environment Block are also randomized. A security whitepaper from Symantec noted that ASLR in 32-bit Windows Vista may not be as robust as expected, and Microsoft has acknowledged a weakness in its implementation.^[34]

Host-based intrusion prevention systems such as WehnTrust^[35] and Ozone^[36] also offer ASLR for Windows XP and Windows Server 2003 operating systems. WehnTrust is open-source.^[37] Complete details of Ozone's implementation are not available.^[38]

It was noted in February 2012^[39] that ASLR on 32-bit Windows systems prior to Windows 8 can have its effectiveness reduced in low memory situations. A similar effect also had been achieved on Linux in the same research. The test code caused the Mac OS X 10.7.3 system to kernel panic, so it was left unclear about its ASLR behavior in this scenario.

NetBSD

Support for ASLR in userland appeared in NetBSD 5.0 (released April 2009),^[40] and was enabled by default in NetBSD-current in April 2016.^[41]

Kernel ASLR support on amd64 was added in NetBSD-current in October 2017, making NetBSD the first BSD system to support KASLR.^[42]

OpenBSD

In 2003, OpenBSD became the first mainstream operating system to support a strong form of ASLR and to activate it by default.^[3] OpenBSD completed its ASLR support in 2008 when it added support for PIE binaries.^[43] OpenBSD 4.4's malloc(3) was designed to improve security by taking advantage of ASLR and gap page features implemented as part of OpenBSD's mmap system call, and to detect use-after-free bugs.^[44] Released in 2013, OpenBSD 5.3 was the first mainstream operating system to enable position-independent executables by default on multiple hardware platforms, and OpenBSD 5.7 activated position-independent static binaries (Static-PIE) by default.^[43]

macOS

In Mac OS X Leopard 10.5 (released October 2007), Apple introduced randomization for system libraries.^[45]

In Mac OS X Lion 10.7 (released July 2011), Apple expanded their implementation to cover all applications, stating "address space layout randomization (ASLR) has been improved for all applications. It is now available for 32-bit apps (as are heap memory protections), making 64-bit and 32-bit applications more resistant to attack."^[46]

As of OS X Mountain Lion 10.8 (released July 2012) and later, the entire system including the kernel as well as kexts and zones are randomly relocated during system boot.^[47]

Solaris

ASLR has been introduced in Solaris beginning with Solaris 11.1 (released October 2012). ASLR in Solaris 11.1 can be set system-wide, per zone, or on a per-binary basis.^[48]