Re:Firefox vs. rthreads
by geofft on Monday April 11, 2016 @11:15AM
(#11472047)
Right, I don't understand this and I couldn't find an explanation of why OpenBSD has rejected it, at least for gettimeofday(). I can imagine the following:
* The vDSO is mapped at a fixed address in every process, making return-to-libc-style attacks easy. This doesn't seem to be necessary, though, since it's a virtual dynamic shared object, and you can ASLR it just like you can ASLR any other dynamic library. Just tell the program where you put it.
* The vDSO (or at least the vsyscall page, not sure if this is still true) includes a syscall instruction, making it a juicy target for return-to-libc-style attacks. But for gettimeofday() you don't need that. Just include the instruction to read some dedicated read-only page from memory-mapped timer hardware, or run RDTSC, or whatever, and make your ABI such that it permits the vDSO call to fail and regular libc code might have to make a real syscall if it does. Or that the vDSO isn't guaranteed to be present, and is missing if hardware support is missing.
* The vDSO is mapped at a fixed address in every process, making return-to-libc-style attacks easy. This doesn't seem to be necessary, though, since it's a virtual dynamic shared object, and you can ASLR it just like you can ASLR any other dynamic library. Just tell the program where you put it.
* The vDSO (or at least the vsyscall page, not sure if this is still true) includes a syscall instruction, making it a juicy target for return-to-libc-style attacks. But for gettimeofday() you don't need that. Just include the instruction to read some dedicated read-only page from memory-mapped timer hardware, or run RDTSC, or whatever, and make your ABI such that it permits the vDSO call to fail and regular libc code might have to make a real syscall if it does. Or that the vDSO isn't guaranteed to be present, and is missing if hardware support is missing.
Any further information here?